There are essentially two scenarios here:
- The behavior is technically correct, you interpret configuration incorrectly
- The behavior is technically incorrect, as caused by something
Unfortunately there are a lot of moving part in processing the comment submissions.
The part most relevant to moderation is in check_comment() function.
It checks:
- if moderation is enabled
- if comment contains excessive number of links
- if comment contains blacklisted words
- if moderation is loosened for known commenters
This involves multiple options and some filters, any of which could be going wrong. Beyond this it’s impossible to make a better guess, it will need hands on debug.