what version of osquery are you using? older versions used to auto-enable event collection on Windows as soon as --disable_events=false was passed (which I think was a default in Fleet up until recently)