Well to start with I wasn’t saying it in relation to any hardened mode setting. And your question wasn’t asking about either setting, just hardened mode.

Just my opinion, if you are looking for differences between settings - I would say that it is more likely on Moderate when there is no checking against the avast cloud, which depending on the circumstances the file information may already be on the avast cloud database.