Why a bot sees nothing by default
Telegram protects group conversations from bots. Unless a bot is an admin, or privacy mode is turned off for it, it does not receive ordinary messages at all. That single setting explains most reports of a moderation bot that appears to do nothing: it is not broken, it is not being shown the messages.
The rights that matter
Delete messages is what anti-spam and filters need. Restrict members covers warnings, mutes and bans. Pin messages is for announcements. Invite users matters if you use invite links or join checks that add people back.
Give what the modules you enabled need and nothing else. A bot with every right is a bigger problem on the day its token leaks.
Admin versus privacy mode
They solve the same problem differently. Making the bot an admin is the normal route and is what most groups do. Turning privacy mode off in BotFather is the alternative for a bot you do not want promoted. Either way, the bot has to be able to see messages before moderation or analytics can act on them.
What to check when a module looks dead
Check admin status first, then the specific right that module needs, then whether the module is switched on for that group. In that order. It is almost always the first one.
Keeping the token safe
A bot token is a password for your bot. Tokens are encrypted at rest with AES-256 on the platform side, and the thing that ruins a group is a token pasted into a screenshot. If that happens, revoke it in BotFather and reconnect.