When requesting a review of the categorisation, what actually happens? Is it checked by a human?

The flagged domain is then reviewed manually by a human. This is a dedicated team at Meta, although details about the team and their processes are strictly guarded. What is known is that any information across the data source that may provide sensitive health information is subject to review against their policy. The homepage is likely where they will start though. They will not be able to review unpublished pages.