The Business rule 'Trigger RAVE Alert (new to in progress)' is the cause of this issue. 

The Business rule "Trigger RAVE Alert (new to in progress)" is active on prod instance and it is making a "current.update()" action in its script.

 

It is recommended that we should never use "current.update()" in a business rule, as it will cause recursive business rule calls. 

 

So In our case, since we call "current.update()" in the Business rule, it will trigger "before" business rules again and due to this reason, we are seeing the incident state update twice.