On a really paranoid system where no other personas should be present, then yeah it could be that often. But in general, no, not every IP, Maybe not even every round or minute. It depends on the system and how secure it is as well as how busy it is. Remember, they (IC) need to scan all the icons present to look for intruders so if the system is a busy place then that takes time.
If you want those tests to detect you to stop or become a non-issue, just disarm the analyze software on the system or else create a legit account with your hacked admin account and then log in again with your new legit account. The system will think you belong and leave you alone.
Basically, the more secure the system, the more frequently it should check if you are actually legit or not. Disarming the analyze against you makes that very difficult for the system so should be a first step after you analyze the node yourself.