That seems to be the case …
I modified the my rlm_perl.ini file to:
[Attribute Filter-Id]
dir = user
userAttribute = groups
regex = CN=(.*)
This now results in three Filter-Id attributes in the RADIUS Access-Accept, one for each value in the “groups” array.
Thanks.