I added a comment to this issue about packs, experimenting the same problem and I hope it helps https://github.com/osquery/osquery/issues/3381