Why does my 802.11ac router keep flagging my WoW login as a port scan?

Spent the last hour staring at the router's syslog while trying to queue for a raid. Every time the client does the TLS handshake with the login server, the IDS throws a "Potential SYN flood" alert and drops the packets.

• Wireshark shows a burst of 0x1F4 (500) SYNs to 104.244.42.1:443 – that's just the client negotiating multiple HTTP/2 streams, not a botnet.
• The router's firmware (TP-Link Archer C7 v5) is still using the default Snort 2.9.20 ruleset, which hasn't been updated since the "ZeroLogon" fiasco.
• I tried disabling the "Aggressive Portscan Detection" rule (SID 2100498) and the alerts stopped, but now the raid leader keeps getting "Connection timed out" errors.

Anyone else had to tweak their IDS signatures just to get past the "CVE‑2023‑2860" false positive on the WoW auth servers? I feel like I'm balancing a firewall config like I'm raiding a mythic boss – one wrong tweak and the whole group wipes.

TL;DR: My home router thinks my legit WoW login traffic is a malicious port scan. Suggestions? Maybe a custom Snort rule that whitelists 104.244.0.0/12 for port 443?