1. "The time to file a SAR starts when the organization, in the course of its review or on account of other factors, reaches the position in which it knows, or has reason to suspect, that the activity or transactions under review meets one or more of the definitions of suspicious activity."http://www.fincen.gov/statutes_regs/bsa/bsa_faqs.html
Your 30 day clock starts ticking once someone decides the activity is reportable.
2. Include all activity that you are aware of that meets the definition of unusual or suspicious, after performing your research into the activity. However, if questioined by your auditor or a regulator, be prepared to explain why one employee thought the activity was not suspicious when another one believed it was. There could be many reasons why your colleagues came to different conclusions. Of course, if the reason for the discrepancy warrants its own action (retraining, revising employee duties, implementing a 4-eye alert review policy or QA sampling, etc...), be sure to take it.