The 99% cpu is caused by PCRE pattern matching, when processing mod_security rules, rebuild LSWS with reduced PCRE looping limit, the 99% cpu problem is gone.
Then there are a few mod_security rules block the POST request, enable debug logging with "SecDebugLogLevel 9" in /etc/httpd/modsecurity.d/modsecurity_crs_10_config.conf, located a few offending rules, comment them out, the site template can be updated now.