Decreasing "Check delay" with "Max Connections" constant actually decreases the likelihood of false positives as the period in which connections are counted gets smaller. We haven't encountered any impact on the server resources with this setting.
DoS protection in Imunify360 (as of the version 2.5) works the following way:
Imunify360 agent counts simultaneous incoming TCP and UDP connections from any single IP and if their number during the "Check delay" becomes greater than "Max Connections", the IP is added to a local graylist. Note, that all incoming connections (not only malicious) are counted in DoS protection module. (That's actually the reason why it is disabled by default in Imunify360 agent)

Hope this helps.

Thank you. Yes, your explanation was indeed helpful.