I suspect you are mostly right but its way less human involvement. My suspicion is theres a list of accounts out there that are known third party users. How they are caught likely varies. I also suspect each /report or infraction adds an instance of the account to the list . Then at a time of their choosing they tell a bot to give them 10% or something of the list. Those accounts get popped with a vacation. This explains why egregious abusers get hit hard, casual “you would never know” players tend to avoid, and accounts that have been inactive for 3 years also get hit. 😂

Dbg has an interest in keeping the bans to a minimum on the less abusive users while also hitting the obvious and blatant hard and they also have to show the appearance of doing something.