While working on T299358: dumps.wikimedia.org access logs on stat1007 are incomplete since May 2021 (possibly earlier), in the #wikimedia-analytics channel, we noticed that the problem is possibly caused by neither systemd nor rsync expanding the glob pattern * in the job command.
Quoting from my local rsync man-page:
Note that the expansion of wildcards on the command-line (*.c) into a list of files is handled by the shell before it runs rsync and not by rsync itself (exactly the same as all other Posix-style programs).
Looking through puppet for more instances of this pattern, this came up:
I have no idea what it does, but it might be broken and should probably be checked.