Hi, differential scheduled queries at first run will send all rows as “added”, is there a way to avoid this? thanks!

No, this is just standard behavior of osquery.