Hello, this is Emily.
This behavior is actually completely normal as long a internet remained connected the whole time.
All of the findings during the scan are potential/suspicious ones. Think of it as the scanner are marking those so that at the final phase (which requires internet), it can check them against virus definition. This is where the scanner will perform a MAPS (Microsoft Active Protection Service" request to connect to the cloud server, and to upload these initial findings for confirmation. This is why you received a different total number at the end. If it came back with nothing, it means the scan went through finding no threats.