mark has a good bet… From https://github.com/osquery/osquery/pull/5368

Important to note I had to remove the optimization on both the user and group tables that just called getpwnam if the query specified the uid or gid since the struct returned doesn’t contain the IsHidden attribute. I’m not sure if or how much this will affect performance since I wasn’t able to get the profiling to work with the new version (very likely I’m just doing it incorrectly).

If I add that optimization back in, then the query returns promptly. It is still hitting the table a bunch, so I think there’s a query planner bug somewhere