I forgot to update this since there was Thanksgiving break and the whole family got covid.

Anyways, seems to be related to Cisco Secure Endpoint. We uninstall that and the issue never happens. Install endpoint and was able to reproduce.