It looks like something is starting osquery automatically.

It’s a service I’m fairly sure - it was last time they posted.