A normal form is sent as a single string of name=value pairs. When a form includes a file upload, the browser instead splits the body into parts separated by a boundary string that is declared in the Content-Type header. Each part has its own small header, giving the field name and sometimes the file name and type, followed by the data.
The format is flexible, which makes it more work to parse. The server has to find the boundaries, read every part, and decide how to store text fields and files. Parsers differ in how they handle odd input, such as missing boundaries, a very large number of parts, repeated names or extra headers.
For that reason, multipart parsing has been the source of many vulnerabilities and WAF bypasses. If the WAF and the application read the same body differently, a payload can hide from one and still be seen by the other.
Accept multipart only on the endpoints that need uploads, limit the number of parts and the size of each, and keep the parsing library up to date.