Usually a project is being put back on review if the system detects that it needs to be reviewed again.
This is intentionally vague, so people cannot “game the system” and attempt to upload malicious content without triggering the review to happen. It’s hard to tell what you can do to not trigger it.