On-chain transaction monitoring & SARs

Hey everyone, still wrapping my head around the practical application of TRM and similar tools for crypto. Specifically, when does a cluster of smaller, seemingly unrelated transactions on $BTC (like multiple low-value sends to different wallets, then consolidated) cross the threshold for internal review or a SAR? Is there a clear aggregated value or pattern that triggers it, or is it more qualitative based on destination/source risk scoring?