Duplicate incidents created by NRT rule

Also experiencing the same thing with NRT MFA Rejected by User and NRT New access credential added to Application or Service Principal. Seems to have started since the 3rd Jan for us, there can be one or two entries in Log Analytics but there will be an alert firing every minute for over an hour. As a temp solution we added grouping for 12 hours because last week we had ~150 incidents generate for one event. Tried looking for some kind of change that may have occured in github but not seeing anything obvious. Why are NRTs suddenly firing repeat alerts on the same historical logs?

Note the timeframe vs created time, this is because the logs are the same.