(Serengeti)
what scans does the AV policy for the group specify?
The Administrator-defined scans include any scheduled scans you might create e.g. weekly plus in the Advanced tab there are:
startup scans when user logs on
active scan when new defs arrive
The scheduled scans will have a retry period, which will make them start within x hours or days if they are missed. Maybe some clients are starting again within that retry period?
The client scan log will show when scans ran. It displays what kind of scan - manual, Defwatch, Startup, Scheduled.
Cross-check with the Windows Application log - source: Symantec AntiVirus, Event ID2 - scan completed, Event ID 3 - scan started