Glancing at the app store review guidelines[1], I will note that this app's listing[2] is low-key violating the privacy policy requirement by just linking to the github repo for the app, which has no actual privacy policy listed. I have no idea if that's enough for Apple to do a suspension-and-review process like this, but it's definitely a violation.
That said, I think they should include at least some hint in their communications about why they're reviewing you, particularly if it's going to take as long as it looks like this one has.
[1] https://developer.apple.com/app-store/review/guidelines/