To simplify: the network fetch is done once in full, then only the "top of the list" is refreshed once or twice a day to minimize risk
Also, the fetch times are randomized rather than occurring at a fixed time every day (e.g. 8:00 AM), which would be an extremely obvious automation signal