I'd recommend to use latest rulesets.
mod_security is our upstream and keeps updating frequently. so we're lag with them almost all the time. But 1st, I don't think mod_security is all of security; 2nd, one fact I know of, when I log in our customers' server, I see quite a lot of them...