Choose Imperva. We used this WAF in conjunction with ImmuniWeb (they have partnership) https://www.htbridge.com/immuniweb/partners/TAP/. No complaints. Zero false positives and no cost for integration. Plus.

As already answered these are two different things. Sonar is good and unlikely you will find an alternative. As fo Checkmarx there are some other appsec products which deserve looking at. First of all ImmuniWeb, also Qualys, Acunetix, Veracode.