AML Transaction Monitoring - When do you flag a 'smurfing' pattern?

I'm still wrapping my head around AML and specifically transaction monitoring for potential smurfing. I get the basic concept of structuring deposits to avoid reporting thresholds. But in practice, especially with high-volume accounts, when do multiple smaller, seemingly unrelated deposits start looking like a pattern you'd actually flag for further review? Is there a common number of transactions or cumulative amount within a timeframe, or is it more about the source of funds and the account holder's typical activity? What's your internal threshold or the red flag that makes you dig deeper on this particular pattern, aside from just hitting the CTR mark?