Ubuntu server 18.04: suricata rule blocks dwservice, but not teamviewer or anydesk

Hard to say. Did you enable the drop log facility in EVE? It should tell you more about what rules lead to what drop.

        - drop:
            alerts: yes      # log alerts that caused drops
            flows: all       # start or all: 'start' logs only a single drop
                             # per flow direction. All logs each dropped pkt.