Does the ‘nav_menu_css_class’ filter accept 2 or 3 arguments?

I can confirm that this filter applied with 3 parameters as you mentioned in your snippet. The warning is very strange and shouldn’t appear if WordPress core wan’t hacked.

The best practice for this case is to request parameters, which are required by your hook. So if you don’t use $args, so don’t request it:

add_filter( 'nav_menu_css_class', 'wbwcrf_nav_menu_css_class', 10, 2 );
function wbwcrf_nav_menu_css_class( $classes, $item ) 
{
    // ...
}

Another approach is to set default values for income arguments:

add_filter( 'nav_menu_css_class', 'wbwcrf_nav_menu_css_class', 10, 3 );
function wbwcrf_nav_menu_css_class( $classes, $item, $args = array() ) 
{
    // ...
}