For the second host in the graph, as you can see, there is no Check threshold found. Why? The only difference is 5 minute posting from Telegraf vs. 1 minute. Host 8302068 does not go to WARN.
I think the behavior is correct. Your query states that if either host goes below the threshold value, the state goes to WARN. I suspect that the result of your query will have multiple tables, or at least multiple rows, one for each host. You can check that by looking at the raw data of your query.
So the “host” column you are referring to is just taken from one of the rows.