The admins of the groups are responsible for managing the discussion in groups including frontline anti-spam against the porn bots and the shoe bots and whatever. So it's semi-distributed moderation. (Assuming group admins care, but if they don't then users just abandon the group.)
Compared to e.g. Reddit, FB groups aren't as world readable or writable as subreddits are so you don't really get that classic inter-subreddit drama.
Where global moderation is still needed from FB's perspective is when group activities start spilling outside of that group, e.g. because they're coordinating extremist activity.
This probably won't be the result of user reports though. For privacy and scalability that implies an automated system which (hopefully reliably but only rarely) flags posts to a human working for FB.