Having only the names of the config files instead of their actual content is only barely useful, since one can only guess what the content of the config might be.
Check SecDefaultAction in your crs-setup.conf and make sure it actually is set to deny and not only log (which is usually the default), i.e. something like this
SecDefaultAction "phase:1,log,auditlog,deny,status:403"