If you have a page, with CSS, a few images, a favicon and perhaps a .js or two, when the browser requests the page, it now needs to fetch all of the rest of the files. Depending on whether keepalives are supported by either side, pipelining, etc, I would think that you could easily see 5+ requests per second from a connection that was legitimate.
Unless whatever product you're using is limiting only fetches for .html, I would think that 5 would be too low. You would want to find out what they are limiting and your general page construction to figure out what could reasonably be assumed to be requested in a second.
There is a balance between security and usability. Too much of one negatively impacts the other.