Is it possible that in one of those groups, kids photos were shared? Perhaps the algorithm somehow classified the photos being shared as CP?

She's probably shared photos of our kids with her parents and that kind of thing, but nothing that would reasonably be classified as CP (obviously) - although who knows what could cause a false positive. She did receive that spam group message though, and has gotten others in the past; anything could've been in there.