Gravity Scan and critical files

Have just run a Gravity Scan on a site and it flagged 22 Critical Malicious files. I searched for these on the site and found none of them. It also listed a huge list of Plugins Found of which only a few are actually on the site.
It was run at Ultra Low intensity.
This is going to be a very time-consuming setup if this happens with all my sites.
I really don’t understand how it can find plugins that aren’t there and never have been there unless I am interpreting it incorrectly?
I use Wordfence on all my sites and was going to add Gravity Scan as well but it will certainly take some time.
Thank you