Something I came across with SCOM 2007 but still seems to be an issue with SCOM 2012. In rare cases when an agent exits maintenance mode it will reprocess all events in the event log and generate alerts for old events.

Adding the following registry key will correct this issue:

HKLM\Software\Microsoft\Microsoft Operations Manager\3.0\Modules\Global\NT Event Log DS

Create a DWord value named MaxEventBufferSize and set it to a decimal value of 500000.

You can also clear the event log on the effected machine although the issue may reoccur.