At my previous employer I took a unique approach to doing this. At first I was going the same route you were doing trying to calculate the start stop timing of the alerts. I couldn't figure out a way to do it effectively so I went another route.
In my alert I wrote to the event log the following every 30 minutes the circuit was over my 80% threshold. Circuit Exceeding 80% utilization. I then wrote a report that counted the number of times this was recorded in a day/week/month. That information could then be extrapolated out so that if it fired 10 times I knew that the circuit was over utilized for 300 minutes.
My network manager really liked this approach and we then did the same thing for 60%. This allowed us to kind of target bandwidth upgrades. Nodes at the top of the 80% list were targeted for immediate upgrades while the 60% nodes we were keeping an eye on.