Migration is triggered any time a sandboxed process attempts write, overwrite, rename, or attribute-change access to a file that exists on the host but has no corresponding copy in the sandbox yet. Read-only access to an existing host file never migrates; that is served directly from the host.
If this issue did not start occurring in the latest version of Sandboxie Plus, something else must be causing this behavior. For example, a third-party security application (such as an antivirus or anti-ransomware tool) may be interfering by forcing additional file operations or blocking Sandboxie's normal read/write redirection.
If an app is causing this issue, you need to use DontCopy=* or a specific rule like DontCopy=program.exe,*.exe . However, doing that can have other side effects, such as breaking the functionality of the sandboxed program.