AML Red Flags and "Reasonable Suspicion" - How do you draw the line?

Hey everyone, still relatively new to the compliance side of things and I'm grappling with something.

We're constantly bombarded with training on AML red flags – unusual transaction patterns, geographically mismatched activity, sudden large cash deposits, etc. I get the why behind them. But when it comes to practical application, I find myself second-guessing. At what point does a 'red flag' move from being just a data point to triggering 'reasonable suspicion' that necessitates an SAR filing? Sometimes it feels like if you look hard enough, you can find a red flag in almost anything, especially with smaller, less established clients. How do you seasoned pros manage this subjective element without over-reporting or, worse, under-reporting? Are there specific internal frameworks or decision trees you use that help clarify the threshold for action?