We don't know what they are doing. I suspect it may be some sort of background check on you or your business, or maybe a more forensic analysis of the app to look for malware / backdoors - but that's just my speculation. The fact that it's your first submission may make a difference. It may be random, or it may be due to the particular nature of your app.
I've been doing this for more than a decade, and review times have gone up and down. I did once get the "additional time needed" message, and I think it was resolved in a couple of weeks - with no clue what they had actually been doing for that time, except that my server logs indicated that they had not actually used the app in any significant way, IIRC.
Others may have other experience / opinions. You could try searching the forum for "additional time" or some other phrase from the email - but the forum search is so crap you may not find anything.