getting more than what you expected ‘hits’ before a ban is because depending on fail2ban’s ‘backend’ it often can’t keep up with reading the logs, the publisher recommends you install and use pyinotify for speediest effect
(they also recommend that you use a currently supported version of fail2ban , but that’s a different story 
)