If you can get verbose logs from that happening it would help (a verbose log with slightly more info occurs just below the warning you saw https://github.com/facebook/osquery/blob/master/osquery/events/events.cpp#L284). Any repro steps. A copy of the DB if possible.