Clean install problems vs upgrade NO problems

Question

So bear with me, this may be a little long and potentially confusing... At a client, using local AD, ~80 PCs (about 60 are Win11 Pro, remaining are Win10 Pro), their policy is when they get a new system, say a Dell OptiPlex, that the system be formatted with an ISO downloaded from Microsoft's official site so that all the bloatware that OEMs preinstall are truly gone. I've built a thumb drive using the Media Creation Tool several times (meaning no customizations whatsoever) now using the RTM version of Windows 11 Pro 22H2 directly from https://www.microsoft.com/software-download/windows11. When I format the system using that thumb drive of Win11 22H2 & join it to the domain, everything is fine; however, when I apply the latest Windows Updates, after the reboot, the entire Taskbar turns gray (no Start button, no icons, no System Tray) and I lose access to notepad (says admin has blocked access to it) as well . I thought it was some errant GP setting (I am using the latest Administrative Templates), but NO other Win11 box is experiencing these issues whether they're on 21H2 or 22H2 (the the 21H2s were upgraded from Windows 10 Pro 21H1 and 22H2s currently in production were upgraded from 21H2 using an ISO downloaded from the site above).

Now here's where it gets fun. If I take a Windows 10 Pro 21H2 thumb drive, do a clean install on the SAME system, then upgrade to 22H2 using an ISO downloaded from the same site above, the issues do NOT happen! Now for another twist, if I apply the latest updates to a clean Win11 22H2 install using the same thumb drive BEFORE joining the domain the issue does NOT happen. Yes, I know can apply Windows Updates with new installs before joining the domain, but now I'm afraid if I deploy a ton of new systems that 2 weeks from now when October's updates hit that users will be dead in the water. Any thoughts? Having to start with Win10 and upgrade to Win11 22H2 is just such a huge waste of time.

This has happened on 2 different OptiPlexes now. One, and OptiPlex 5080, was at an employee's home so to be safe it was formatted and the other is brand new an OptiPlex 5000. Different generations of PCs. Both have 16GB RAM, both i7 processors, both are hardwired to the LAN, using the same domain admin account to log into both. The issue happens to any account on the machine, even the account added during setup.