Did anyone have success in configuring Mod security?
Using OWASP CRS v3.0.2 (https://github.com/SpiderLabs/owasp-modsecurity-crs/releases/tag/v3.0.2) you should find no major issues here. Drupal has it's own set of exclusions out of the box because it does things that can be considered bad practice (passing tags via parameters, etc). As outlined in the docs you should uncomment rule 900130 and enable the Drupal exceptions. There is even an example of how to do so.

https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.0/master/crs-setup.conf.example#L302

Enjoy!