There are a couple of system components that can activate GPS, which may escape the attention of privacy apps. Not sure if I recall correctly, but the camera could be one of them (if GPS location info is turned on in settings). I remember this as being fairly persistent until the system had a good idea of the location (i.e. the only thing that made it stop was turning off location access in the system settings). A couple of different system apps run under the same app id (making it difficult to figure out what exactly is triggering something) and XPrivacy by default doesn’t restrict system apps (which also includes Google Play Services, if installed).
Bizarrely, there also seems to be a link to the use of mobile data with some SIMs (e.g. this topic). As this also doesn’t appear to be linked to a specific app, this probably also wouldn’t trigger a notification.