Hi everyone i'm trying to understand something about DLP mostly for Sharepoint and Onedrive

I made a policy for audit that checks Exchange, Teams, Onedrive and Sharepoint, then i have some rules that check for stuff sent outside our tenant and some inside

The issue i'm having is

1) It seems that each time someone uploads something to a sharepoint that has sensitive information it triggers the DLP rule, i though it was only for sharing? (ye i know Sharepoint is a share site so i'm guessing uploading a file is auto considered a sharing action?)

2) Onedrive we are getting hit from users that are disabled for like 3 months ago and their onedrive are disabled, it says the document was shared, but i cannot find to who, when i go to audit no one tries to access his Onedrive, user is disabled without a licence and when we try to get more info it says the onedrive is archived

Thanks