It appears that a reasonable answer is
SecAction "phase:1,id:'981214',t:none,nolog,pass, \
What this gets you is is a check during the logging phase; if there has been two or more bursts, then the offending IP address will be sent to the corner for a timeout, and ALL subsequent requests from that IP will be forbidden until the timeout expires.
When testing, keep in mind that (a) more than brute_force_counter_threshold requests make up a burst, 2 bursts lead to a block, and that block starts after the request that trips the second burst. (If brute_force_counter_threshold = 3, you'll see 8 unblocked attempts before the blocks start).
brute_force_protected_urls allows you to specify multiple vulnerable points
but if you want multiple policies, you'll want a second copy of modsecurity_crs_11_brute_Force.conf with search and replaced variable names.