Alright, I've got another update and seemed to have reworked things so this is fixed. I've removed all of the old rules and created a new one under WAF Rules using the following:
(http.host eq "https://my.cloudron.tld" and ip.src eq 127.0.0.1 and http.request.uri.path contains "/filemanager/") or (http.request.uri.path contains "/api/v1/apps")
Then take action: Skip
Log matching requests: turned on
WAF components to skip: All managed rules
More components to skip: Managed rules (previous versions)
Note: Edit the items in bold to reflect your Cloudron Domain and your IP Address.