I've been monitoring this for two years. 99% of the time, when a group registers FileModified or FileModifiedExtended activity on the SharePoint site within the expiration period, Microsoft auto-renews the group. I've found that groups that have a high number of audit log events during the expiration period seem to be ignored by Microsoft. Those heavily-used groups enter the expiration process immediately and our group owners get these confusing messages from Microsoft. My guess is that whatever Microsoft uses to detect activity errors out or fails if the number of activities is beyond a certain limit. I opened a ticket last year when this happened and now it's happening again. Microsoft support had no solution for me last year but told me to open a ticket if it happened again. I'm doing that but also posting here. Trying to get the product team's attention because this thing appears to have been faulty for years now.