You might wanna try testing this behavior on osquery 3.3.1. (There's MSIs available in the S3 bucket if you just change the URI), and see if that fixes it