We only scan your code, but require your dependencies to build type information which helps us with analysis. In case of private dependencies, the go module installer clones the repository directly instead of hitting the module cache which increases analysis time.
First analysis run can take some time. Other than that, a freshly created PR run may also take some time. The fluctuation you see may depend on how much time it takes to install the dependencies, and build an import graph for us to start the analysis.