Android phones generating additional ViewReport in Audit Log

My organization loads the Audit Log details to a database using Powershell. This is working just fine, but we are seeing some unusual behavior around Android phones. 

The logs are showing that one person, on a given day, viewed 4 reports within a few seconds of one another. This also happens to have been at 3:30 AM (after accounting for timezones, etc), which is not a time when the user was accessing reports. This then happens with EXACTLY the same timestamps, but on the following day, and may continue for several days. This only appears to be happening with Android phones. I know that at least one of the people affected is using a non-company-managed phone, and thus must use MFA. I suspect that the MFA process is somehow generating these additional ViewReport records. 

Does anyone know if this is an expected behavior? Or is this a bug in the Audit logging? If it's an expected or unfixable behavior, I will create logic to handle it, and I would like to understand why it's the expected behavior.