Any use of private API, even indirectly through a third-party SDK, is an automatic rejection — Apple's static analysis during review checks binaries for private API symbol references.
Almost always caused unknowingly, by a third-party SDK or ad network library that references a private API internally — the app developer often doesn't know until the rejection arrives.
"Your app uses non-public APIs, which is not permitted on the App Store: [API list]. Please update your app..."