Couple things: If it ever exceeds threshold from the time the engine was started, it will pull timing from that cylinder, and will only slowly bring that timing back if passes through the same spot again without exceeding threshold. So if before you started logging, it exceeded threshold on cylinder three - it stored that retard into the knock I-trim table for cylinder 3. It only removes that stored value completely when it resets at Key on, or slowly based on your settings when it goes through the same cell again but without exceeding threshold. Secondly, it's also possible your logging rate is aliasing out some data - there could be a spike that exceeds threshold but you aren't logging at a fast enough rate to capture it.