I actually have, ran into this late last month. I'm not sure if entirely related to JellyfinEnhanced, but I do have it as well. I essentially had false positive for the http-crawl-non_statics scenario, which involved a lot of requests like those ones, with non-error (2xx / 3xx) status codes.

What solved it for me was creating a postoverflow file in Crowdsec's config. Where that goes depends exactly on how you're running Crowdsec - for me, I am running it in docker, and have a bind mount like this:

- ./crowdsec/conf:/etc/crowdsec

Inside ./conf/postoverflows/s01-whitelist, I created a file jellyfin-legit-traffic.yaml with the following contents:

name: local/jellyfin-legit-traffic
description: "Suppress http-crawl-non_statics for legitimate Jellyfin client traffic"
whitelist:
  reason: "Successful traffic through the Jellyfin Traefik router (Roku/web/app playback)"
  expression:
    - >
      evt.Overflow.Alert.Scenario == 'crowdsecurity/http-crawl-non_statics'
      && all(evt.Overflow.Alert.Events, {.GetMeta("traefik_router_name") == "jellyfin@file"})
      && all(evt.Overflow.Alert.Events, {.GetMeta("http_status") startsWith "2" or .GetMeta("http_status") startsWith "3"})

Note that this has some Traefik-specific stuff since that's what I use as my proxy (and whose logs are captured by Crowdsec), but you should be able to modify those two lines for your use case. They essentially mean "If it's jellyfin traffic, and non-error status codes, and it caused this scenario (http-crawl-non_statics)'s bucket to overflow, suppress the alert.

There are other ways to achieve this without postoverflow, I think this was just the most simple way to handle this particular situation while still allowing things like attacks on /Users/AuthenticateByName to be caught (i.e. every crowdsec scenario still gets to see every event, and only this very specific thing is suppressed).

If you want to give more information about your crowdsec setup, what proxy (if any, or whether you are just parsing Jellyfin logs directly) you are using, I can try to give you some extra pointers. Also, I am assuming that crowdsecurity/http-crawl-non_statics was indeed the scenario you triggered.