I've had this issue, pretty much exactly to your description. Disabling Windows Defender seems to have fixed this issue. I tested by disabling through gpedit on single machines. After seeming to have fixed the issue, we have applied this to domain group policy.