What is the exact behavior of Catalina verifying app?

By 'verifying' I mean either - an explicit popup of 'Verifying' - or app launch stuck with XProtectService comsuming CPU in background What I know - An app on local drive with com.apple.quarantine xattr will be verified on the first start, or after something changed in the app. However I found some app on without the xattr will still be verified, especially app copied from (or directly run on) an external/network drive. - What is the exact behavior? - Anyway to avoid this (without fully disable SIP)?