Sometimes network discovery generates service discovered events even if service is continuous running on remote host.
It could be caused with single package lost, hard to say. Such situations generate unwanted discovery actions.

In my opinion it could be fixed by adding option to specify number of check attempt when service state is changing. For example if SSH discovery check failed, when previous time it was in UP state, discovery process should run next attempt before generate event

If there is currently another mechanism to avoid problem with generating unwanted discovery events in Zabbix, please let me know