Check these things:
Have you restricted the URL and date-range settings on the waiting room to only the elements and times you want to protect?
Have you set the rate to a reasonable number to allow for background traffic?
Do you have an API connection issue? Do you need to enable Trust on Fail?