Something to bare in mind if you upgraded your SCOM 2007 environment to SCOM 2012 is that any AV exclusions you may have had in place for the monitoringhost.exe and similar processes will need to be redone. This is due to the installation path changing during the upgrade process.
The default installation path for SCOM 2012 RTM / SP1 is as follows:
Agent: C:\Program Files\System Center Operations Manager
Server: C:\Program Files\System Center 2012\
Something I came across with SCOM 2007 but still seems to be an issue with SCOM 2012. In rare cases when an agent exits maintenance mode it will reprocess all events in the event log and generate alerts for old events.
Adding the following registry key will correct this issue:
HKLM\Software\Microsoft\Microsoft Operations Manager\3.0\Modules\Global\NT Event Log DS
Create a DWord value named MaxEventBufferSize and set it to a decimal value of 500000.
You can also clear the event log on the effected machine although the issue may reoccur.