any idea how I can remediate

EndpointSecurity client lacks user TCC permissions

?

you might need to approve Full Disk Access to osquery. This is done in System Preferences -> Security & Privacy -> Privacy -> Full Disk Access