If I edit the build prop for S Health fix or edit anything with Root Explorer does that trip Knox (it's frozen in Titanium Backup), or is it only installing custom recovery and roms?
You have not, nor can you freeze the important part of Knox because it's located in the bootloader. The bootloader checks the kernel & recovery signatures and so forth on boot. Failing the signature check there is what increments the Knox flag 99/100 times.
So custom kernels or recovery, some rooting exploits or perhaps attempting to downgrade to a JellyBean bootloader will change your Knox flag. And in rare cases, just splendidly bad luck e.g. having a bad kernel crash at just the wrong time or say from the corruption resulting from a power interruption during a firmware write.
Note that you do not need to edit build.prop to make S Health work and any unsound edits there may render your device unbootable until you remedy them. But we wouldn't expect edits there to increment Knox. Not that it's impossible, but it would be a rare thing where an edit spun a fatal error during the actual signature check or something of that nature.
.
