I'm assuming it's tracking your IP like you'd track someone in person.
They could be tracking anything. IP address, browser fingerprint, personal details you gave to the vendor, even physical delivery address. I'm quite surprised OP was able to make the initial purchase at all, as I was under the impression that BitPay were now starting to request blanket KYC for every user on every purchase.
According to the BitPay API
documentation for creating an invoice for a customer to pay, the merchant has to give Bitpay the customer's name, address, email and phone number. If you are buying digital goods, you could potentially provide made-up information that changes, but if you need whatever you are buying to be shipped to you, there is a limit as to how much of this you can change.
As others have noted, BitPay only requires KYC verification if a "transaction" is above $3000, or $1000 for refunds. The OP said he placed an order "yesterday" and was asked to perform KYC verification "today" when he tried to place an additional order. It is possible the order the OP placed "yesterday" was actually placed "today" according to whatever timezone BitPay is using to track transactions. I would suggest to the OP that he make sure 24 hours have passed since he placed his prior order and try placing his order again.
Placing many $2990 orders within a short time frame may be frowned upon by BitPay, and doing so might cause them to force you to complete KYC verification on the next order you place, regardless of amount.