I've noticed that the following scheduled Tasks have never been executed on my master Image:
Windows Defender Cache Maintenance
Windows Defender Cleanup
Windows Defender Verification
All of them are stored under \Microsoft\Windows\Windows Defender.
Maybe something to consider when sealing the master Image?