This could be Berkson's paradox (https://en.wikipedia.org/wiki/Berkson%27s_paradox) in action. Larger projects probably have more toxicity than smaller projects and are more likely to have a CoC. The result is that the two factors appear to be correlated even if they are independent variables.