mod_security causes CGI scripts to timeout

Describe the bug

After enabling mod_security in our Apache 2.4 configuration, more and more, but not all, CGI scripts will timeout and not usually immediately after restart but after a few minutes. As soon as mod_security is disabled, the issue goes away and all CGI scripts behave normally.

Logs and dumps

There are no mod_security logs, only Apache error logs like so....

[Wed May 22 12:40:46.262612 2019] [cgi:warn] [pid 198045:tid 139887210845952] [client 10.235.31.231:0] AH01220: Timeout waiting for output from CGI script /var/www/global-cgi-bin/web-info
[Wed May 22 12:40:46.262653 2019] [cgi:error] [pid 198045:tid 139887210845952] [client 10.235.31.231:0] Script timed out before returning headers: web-info

To Reproduce

Steps to reproduce the behavior:

A curl command line that mimics the original request and reproduces the problem.

curl -v http://somesite.corp.com/cgi-bin/any-shell-script

Expected behavior

I expected the CGI script to return it's output

Server (please complete the following information):

• ModSecurity version (and connector): ModSecurity 2.9.3 with patches from Rainer Jung in issues #2091, #2093 however issues exists with or without the patches applied
• WebServer: Apache 2.4.39
• OS (and distro): Linux SUSE11 SP4

Rule Set (please complete the following information):

• Running any public or commercial rule set? Owasp
• What is the version number? Owasp 3.0

Additional context

This may be connected to filter processing issues seen in issues 2091, 2093

Re-reading the traces and the source code, everything points to the httpd parent never seeing any output from the CGI script, not even headers, in cgi_read_bucket.

https://github.com/apache/httpd/blob/2.4.39/modules/generators/mod_cgi.c#L694

How could mod_security interfere with the mod_cgi buckets in the output bucket brigade?