I need help - PCI DSS 4.0 requirement 11.6.1

Hi everyone,
I’m currently working on PCI DSS 4.0 requirement 11.6.1 validation for a payment page that contains payment buttons and client-side scripts.
Our objective is to verify that both F5 Distributed Cloud Client-Side Defense and Radware Client-Side Protection are able to detect:
Unauthorized modifications to HTTP headers or script delivery.
Client-side tampering attacks affecting payment page components.
Changes to JavaScript resources that should trigger an alert from the monitoring solutions.
I’m specifically looking for practical testing methodologies, lab guides, or Burp Suite techniques that can be used to simulate these scenarios in a controlled environment.
For tampering tests, I’ve found some basic Burp Suite examples, but I’d like to know:
How do you typically test PCI DSS 11.6.1 in real assessments?
What client-side modifications have successfully triggered F5 or Radware detections?
Are there recommended attack scenarios for validating script integrity monitoring?
Have you used Burp Suite, browser developer tools, MITM proxies, or custom JavaScript injections to simulate unauthorized changes?
Any guidance, test cases, references, or lessons learned would be greatly appreciated.

Environment: Payment page with hosted payment buttons, testing performed in a non-production environment. Goal is to generate valid PCI DSS 4.0 Requirement 11.6.1 evidence and confirm detection capabilities of both F5 Client-Side Defense and Radware Client-Side Protection.

Thanks!