I had a report that would run on the first Thursday of every month. It had been working for months. Recently, it startign running more than I expected based on how the cron was written, and the only thing I can attribute it to at the moment is that we upgraded to 7.3.4 from 6.1.1(I think).
The cron is: 0 4 1-8 * 4
What it is doing now is running every day from the 1st to the 8th of every month, and running every Thursday at 4 am.
According to https://crontab.guru the report is running exactly when you said it should.
Either the old behavior was a bug this now fixed or the cron "standard" has changed since 6.1.1.
If there is no mention of this change in any of the release notes since 6.1.2 then you should file a bug report. Otherwise, submit an enhancement request at https://ideas.splunk.com.
--- If this reply helps you, an upvote would be appreciated.