re: what triggers it, from the report certain orders of preg_match() calls can. It seems apparent that the pfSense GUI does not as everything I've seen is in regards to packages. Perhaps the feeds used (variable size) make a difference?
So far so good.SG-3100 - 21.02p2 - Clean install
Actions taken in pfblockerNG
1 - Wizard
2 - Maxmind key set
3 - MaxMind Localized Language changed to Brazilian portuguese
Not using geoIP yet, planning to.
4 - Feeds
Noticed that only one DNSBL was in use, ADs_Basic, so I added the following:
5 - Changed DNSBL Mode to Unbound python mode
6 - Unchecked DNS Reply Logging because I don't need it