Darktrace flagging protonmail.me domain as suspicious?

I'm wondering if anyone else has seen this happen recently or know what might be triggering it. I think it's just a bad heuristic detection of the domain by their neural network model based on high privacy = high anonymity = high potential for nefarious use... but the specific alerts or the part of them I can see don't tell me much more than this:

Age of destination [timestamp] Country CH Destination IP [internal gateway IP] ASN AS62371 Proton AG Destination port 80 Watched endpoint source Alienvault OTX Message mail.proton.me DETAILS Device [endpoint name] Score 82% Priority 5 IP Address [endpoint IP address] Subnet [endpoint subnet] Type Desktop First Seen [date/time] Last Seen [date/time]

I'm not overly concerned at this point but I'm curious if they know something I don't or if this is just another case of the LLMification of everything leading to shittier results.