I think that your current WAF is treating curl and wget as malicious traffic, and I figured this out, because if you look at the picture attached called "curl_w_without_burp-proxy.png" the only difference between those two calls is that I am proxying my traffic through burp. So instead of it fingerprinting what is viewing it as curl it thinks it is some type of web browser. Which is why in the first call I am getting garbage (i.e. binary output, which you can see in the picture "curl_binary_output.png"), and the second is the regular key output.