What is you alert/symptom's cancellation interval? If we're talking vCenter adapter, 5min interval, you only have 1 additional data point after the initial firing to cancel it.. otherwise it'll notification out the alert. Try playing with different intervals of delay to notify.. bump it up to 15-20min and set the interval to 0/1 for symptom/alert and see if that addresses it. The cancellation and delay to notify just might be too close for the alert to fully cancel before it get's sent out via notification.
If you find this or any other answer useful please mark the answer as correct or helpful.