Sounds a bit like the extension is trying to activate before osquery is done booting? I know in some of my go code, I hardcode a 10s delay