Interestingly, if I swap the order of the tables, performance on osquery4 improves. But osquery3 seems fine in either order.