What's your "App Privacy" settings? I think the review team checks "App Privacy" settings first and if the toggles indicate the need for ATT then they just reject you in case you don't implement ATT. The question is what's the proper "App Privacy" settings setup to not fall into ATT trap (and don't lie which I guess could result in even more serious issues like removal of the app from App Store completely)..