Suspicious sender display name with long procedurally generated text blob

type.inbound
and regex.icontains(sender.display_name, '\b[\w\p{L}\p{N}]{35,}\b')
and not regex.icontains(sender.display_name, '_bot_[a-f0-9]{32}\)')
and not regex.match(sender.display_name, '\b[\w\p{L}\p{N}]{35,}\b')
and not (sender.email.email == "" or sender.email.domain.valid == false)
// negate org domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $org_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $org_domains
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and not profile.by_sender_email().any_messages_benign