This happens when spamd.service is restarted. I recently upgraded my server from Debian Bullseye to Bookworm.
These are entries in my /etc/group:
spamass-milter:x:119:
debian-spamd:x:120:spamass-milter,amavis
amavis:x:121:vmail,clamav
clamav:x:122:
The directory is owned by debian-spamd. On...