When a new VI is created the BR "Calculate risk score" runs, well.... it calculates the risk score for the first time.

Then, every 30 minutes the scheduled job "Run severity calculator after vuln entry promotion"  run looking for a flag on sn_vul_entry to see if it should recalculate the rules become something has changed on the sn_vul_entry table (i.e. Third-Party - Like the Severy was changed)