Plausibility is not evidence
Timing differences, migrations, reactivations and reporting delays explain a great deal. They are also the first explanation offered for anything uncomfortable, and they are rarely tested.
An anomaly survives only when the records rule out every alternative that would account for it. Anything that cannot survive that test is discarded, and discarding is a normal outcome.
The discipline of discarding
An investigation that substantiates everything it detects has not investigated. Most candidates should fall away, and the ones that remain are stronger because of it.
PERISCOPE briefings describe investigative principles. They do not disclose detection logic, thresholds, formulas, weighting or rules.