Related https://github.com/osquery/osquery/issues/6582 "Duplicate Events"

Hmm thanks for the link. The last bullet point is interesting

If osquery has stopped things, but the OS thinks there are still callbacks, when it's restarted the old things may come back.

Do you know happen to know how to reproduce this?

I don't, sorry, I will have to see if others do