Keep alive is a flag that allows you to reuse a single connection instead of closing it, if it's closed then again you have to renegotiate things. So it sound like you may have been inadvertently spamming them with tls connection requests, the fact that they said they were counting blocked requests makes it passable that you were also sending invalid tls handshakes.
This would make the real issue that they had been previously underreporting your usage and now are correctly counting it. Now if they had wanted to keep your business they should have, you know, warned your first or helped you fix your code instead of just surprising you like that. The fact that the change was going to cause a customers bill to spike should have been a red flag to them.