[Defender] Defender is blocking IPs which are NOT on the blacklist

Hi there,
We're receiving (and have experienced ourselves) site visitors complaining that they've been blocked by Defender, with this message:

"The administrator has blocked your IP from accessing this website."

My own IP was blocked, as well. I was able to log and clear the blacklist, which got everybody back in, even though my IP address (and some readers) were NOT on the blacklist itself. There was a huge number of failed login attempts blocked overnight, but again—not from my IP or the site readers' IPs.

This is an issue that's come up on a few of our sites now, and the only change made to these sites was the upgrade from WordPress 4.9 to 5.0.2.

Thanks for your help.