Do WAFs block/trigger alerts when they just read base64/hex encoded stuff as suspicious input? Or do they decode the strings (the ones which can do that), analyze the result and just then evetually block/trigger some alerts?
That depends entirely on how the WAF is configured.
When you ask "Do WAFs do this thing?", you speak of them as if there were one and only one way to implement them.
In general, a WAF has to be configured for the application in question. For example, a WAF may be configured to block as soon as it sees bits of SQL syntax, as it may be indicative of attempted SQL injection.
This would be terrible in an SQL administration tool, which is used to configure queries in a database. But from the point of view of the WAF, both are just "SQL syntax in a POST request".
So the WAF needs to be configured for what is legitimate and what is not. If your application regularly transmits base64-encoded data, then that is legitimate and will likely not trigger an alert. If it doesn't then it might trigger one.