I shall be more clear.
This happens:
<EventData>
<Data Name='RuleName'>-</Data>
<Data Name='UtcTime'>2022-01-12 18:05:14.616</Data>
<Data Name='ProcessGuid'>{435dd357-185a-61df-b700-00000000a100}</Data>
<Data Name='ProcessId'>912</Data>
<Data Name='Image'>C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17763.2350_none_56f1682d9915d5e5\TiWorker.exe</Data>
<Data Name='FileVersion'>10.0.17763.2350 (WinBuild.160101.0800)</Data>
<Data Name='Description'>Windows Modules Installer Worker</Data>
<Data Name='Product'>Microsoft® Windows® Operating System</Data>
<Data Name='Company'>Microsoft Corporation</Data>
<Data Name='OriginalFileName'>TiWorker.exe</Data>
<Data Name='CommandLine'>C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17763.2350_none_56f1682d9915d5e5\TiWorker.exe -Embedding</Data>
<Data Name='CurrentDirectory'>C:\Windows\system32\</Data>
<Data Name='User'>NT AUTHORITY\SYSTEM</Data>
<Data Name='LogonGuid'>REDACTED</Data>
<Data Name='LogonId'>0x3e7</Data>
<Data Name='TerminalSessionId'>0</Data>
<Data Name='IntegrityLevel'>System</Data>
<Data Name='Hashes'>SHA1=94940755A87F080ACD73AC5B340DD517F221286D,MD5=DE4CE740F33964027F5D685B8027F9FF,SHA256=6DB18B4A74B04D1BBC4D60BECF654B47755EF1019F96468CC3D83AF12FF5237C,IMPHASH=DFA5AA6C71EAA48650B69852FC48ECDC</Data>
<Data Name='ParentProcessGuid'>{435dd357-1819-61df-0f00-00000000a100}</Data>
<Data Name='ParentProcessId'>952</Data>
<Data Name='ParentImage'>C:\Windows\System32\svchost.exe</Data>
<Data Name='ParentCommandLine'>C:\Windows\system32\svchost.exe -k DcomLaunch -p</Data>
<Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data>
</EventData>
</Event>
28 seconds later Sysmon shows no info about parent process.
<EventData>
<Data Name='RuleName'>-</Data>
<Data Name='UtcTime'>2022-01-12 18:05:42.328</Data>
<Data Name='ProcessGuid'>{435dd357-1876-61df-da00-00000000a100}</Data>
<Data Name='ProcessId'>1576</Data>
<Data Name='Image'>C:\Windows\System32\vdsldr.exe</Data>
<Data Name='FileVersion'>10.0.17763.1697 (WinBuild.160101.0800)</Data>
<Data Name='Description'>Virtual Disk Service Loader</Data>
<Data Name='Product'>Microsoft® Windows® Operating System</Data>
<Data Name='Company'>Microsoft Corporation</Data>
<Data Name='OriginalFileName'>vdsldr.exe</Data>
<Data Name='CommandLine'>C:\Windows\System32\vdsldr.exe -Embedding</Data>
<Data Name='CurrentDirectory'>C:\Windows\system32\</Data>
<Data Name='User'>NT AUTHORITY\SYSTEM</Data>
<Data Name='LogonGuid'>REDACTED</Data>
<Data Name='LogonId'>0x3e7</Data>
<Data Name='TerminalSessionId'>0</Data>
<Data Name='IntegrityLevel'>System</Data>
<Data Name='Hashes'>SHA1=5100C0EFC325E646A8D2833E92A4684F6FDFCC39,MD5=8BD17DB41AEF4D9C005BD8488897D859,SHA256=CA51BEC400924928E2A5946FF3AF89F26B3BB4C3F0087FCE45903AF290EA16B7,IMPHASH=C25737B6F6D492CDA69D7F8126F4755B</Data>
<Data Name='ParentProcessGuid'>{00000000-0000-0000-0000-000000000000}</Data>
<Data Name='ParentProcessId'>952</Data>
<Data Name='ParentImage'>-</Data>
<Data Name='ParentCommandLine'>-</Data>
<Data Name='ParentUser'>-</Data>
</EventData>
</Event>
So, on the same host 28 seconds later Sysmon has no clue what the parent process is. And from this time parent process is empty.