The GrapheneOS Usage Guide says:
MAC randomization is always performed for Wi-Fi scanning.
In that same Usage Guide section, there is a link to a Android Developers Blog post with more details about MAC address randomization in Wi-Fi probe requests. That post says:
For each Wi-Fi scan while it is disconnected from an access point, the phone uses a new random MAC address (whether or not the device is in standby).
These two quotes are in conflict with each other. The GrapheneOS usage guide says that MAC randomization is always performed, but the Android blog post says that MAC randomization is only used while the phone is disconnected from an access point.
In the AOSP code, MAC randomization is indeed only used when disconnected from an access point: https://cs.android.com/android/platform/superproject/+/android-latest-release:system/connectivity/wificond/scanning/scanner_impl.cpp;l=170-173;drc=dd920f2cf38d4e36f72a9053adda48548e59148f
// Only request MAC address randomization when station is not associated.
bool request_random_mac =
wiphy_features_.supports_random_mac_oneshot_scan &&
!client_interface_->IsAssociated();
In practice, this doesn't make a big difference. Consider a scenario where a GrapheneOS user is connected to an access point and they've configured the network settings to use the device MAC address to connect. This means that a wireless packet sniffer can already see Wi-Fi packets broadcasted with the device MAC address.
If that same user then performs a Wi-Fi scan, a random MAC address won't be used for the scan. Instead, the device MAC address will be tied to that scan's Wi-Fi probes. Since the user is already broadcasting their MAC address by being connected to the access point, further broadcasting their device MAC address as part of the Wi-Fi scan doesn't impact their privacy much.
Ideally, the GrapheneOS Usage Guide should be updated to more accurately describe when MAC randomization is used.