From brokenpoet.org wiki

The APF deny_hosts.rules file will sometimes get bad entries that will throw errors back at you when APF is restarted.

This is because the entries have text in them . . . This will remove those entries:

for ip in $(cat /etc/apf/deny_hosts.rules | awk '!/#/'| awk '/[a-zA-Z]/'); do apf -u $ip;done

Original solution, which simply removed the lines and left blanks in their place:

sed -i '/\#/!s/.*[a-zA-Z].*//g' /etc/apf/deny_hosts.rules