Here's what MongoDB support summarizes about the current behavior: "Upon consulting with the team, they have confirmed that sometimes change streams can trigger collection scans, but these alerts are an artifact of how we calculate the metric today. Unfortunately at the moment, there is no fix for these alerts"

My suggestion is to fix how the metric is calculated. What is happening in the getmore is not a real COLLSCAN, and it should not be reported (and alerted) as such.

(Bonus points for including context information in the COLLSCAN threshold alert showing the collection and operation. Just knowing there has been a COLLSCAN against N records is not all that actionable.)