I have “distributed_tls_max_attempts” set to 5, but I am seeing the query attempted 15+ times after the osquery process bounces.

This should not be happening. Please file an issue so that it can be investigated. Queries should no longer be sent to nodes once they are stopped in the ui.

Will do, I thought that was the case tool