It is not related to Python. Scanned files will still be located in the cache of the OS file system, so it does not require as much access to the disk as the first run ...
You can reproduce something like:
with open('a 100mb or so file') as fin: filedata = fin.read()
In the second run, most likely the file is still in memory, not on the disk, so the second run will be much faster.
source share