If it helps:
We use kinesis for this the logs and we observed that given an impossibility of publishing (for example wrong creds or absence of internet), it caches the results until it can publish again.
When back online all of the results come at once, but got reports of osquery taking higher resources than expected in the devices.