Jeffrey,
Bear in mind I'm a Linux engineer. (I speak regularly to our AD team). As I understand it, the domain-local memberships are housed in the local domain, not the GC.
If you look at the output of 'sssctl domain-status <domain>', you will see it references two DCs that it's bound to. The local DC and the global catalog server.
So for domain-local groups, it would consult the first DC and get back the proper membership. For universal groups, yes their membership is contained in the GC, so it'd have to consult that second DC (the global catalog server).
That leaves only the global groups. and I think your reasoning is correct for those.
To be honest, when we were transitioning to sssd from our previous AD integration tool, we were under a time crunch. So while we saw (same as you) that not all global group memberships showed up, we didn't have time to deep-dive into the actual culprit. (I suspect it's exactly as you state, because at that time we were doing 'tokengroups = false').
Since we were under a severe time crunch, we just promoted any global group that got called out by the users. We promoted that global group to a univeral group.
I haven't seen a global group getting called out for missing membership in over a year. However, we have transitioned to 'tokengroups = true', so that's likely why.
Spike