Modsecurity without rules don't help. It's very good mod. Impact on servers is usually memory, more rules more memory. Base rules are ok and memory use is acceptable. Ispconfig with open base restrictions, fastcgi and some php functions disabled is secure but again rfi, sql inyection, etc in some insecure aplications from any customer can be a disaster and that is because I use modsecurity.
Thanks for the report SamTzu!