True, a lot of people using dynamic IP addresses might already be on a RBL, since it only takes one computer to have been infected with spammy malware at some point in the IP's lifetime for it to be on the list.

But that's why you don't block straight away if you get a RBL match - by default in the CRS a RBL match gives an anomaly score of 3, and transactions are blocked at 5, so you'd need something else to push it over the edge (suspected XSS attack, SQLi, protocol violations or anomalies, known bad user agent string etc.)