In case of multiple entries of the same domain with different action listed, the API executes the last row in the csv.

Delete actions are prioritized to provide the maximum space available in the feed size post operations

You may have duplicates in between the manual denylisted entries and the threat feed. These two will have the same priority when applicable to a device policy group.