Disavow is treated as routine hygiene and is closer to a surgical intervention. Most sites that file one did not need to, and some damage themselves doing it.
Google largely ignores bad links already
Spam links pointing at a site you did not build are common and normally discounted automatically. The default assumption should be that no action is required, not that a monthly disavow is good practice.
The genuine cases are narrow
A manual action naming unnatural links, or a history of link buying you know about because you or a predecessor did it. Outside those, filing a disavow is optimising against a problem that probably is not there.
The risk runs in the direction people forget
Disavowing is irreversible in practice and easy to over-apply. Teams routinely disavow entire domains that were sending genuine value, weakening a profile they were trying to protect. A file built by pasting everything below an arbitrary authority score is actively harmful.
If you do file one
Work at domain level, document why each entry is there, and keep the file small enough that every line can be justified. Then measure — a disavow that changes nothing after three months is evidence the links were already being ignored.