that's by design. ModSecurity is expensive, it will defeat the speed of cache, bypassed when possible.
if you have to block by user agent, we recommend using other methods, rewrite rule or setenvif + ACL.
Other choice is to setup cache vary by UA, do not cache for blocked UA.