PowerShell Events in Event Viewer When Signing Out and Signing Back Into Discord

Question

this is sort of a Discord question but PowerShell definitely appears to be related so I want to try and get some help with this. in Event Viewer, under Applications and Services > Windows PowerShell, and Application/Services > Microsoft > Windows > PowerShell > Operational, there are events that occur when performing a very specific sequence of events in the Discord app

if I click Log Out > then sign back in > completely close the app > and reopen it, then multiple instances of PowerShell will briefly open in Task Manager for a split second (no console windows), and there will be some events in the PowerShell Event Viewer section

there are 7 event instances of each 'Provider [X] has started' (Registry, Alias, Environment, Variable, FileSystem, and Function). it then continues with the usual 'Engine State is changed from None to Available', before eventually being interrupted by an Event ID 800 event

at the end, it then lists events marked 'Engine State is changed from Available to Stopped'. after that, under normal Discord use, or even when logging out and signing back in without closing the app, no more events get logged

every single one of these events say this: "powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -"

the 1 Event ID 800 event that happens every time says this:

Pipeline execution details for command line: $OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens.

HostApplication=powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -

CommandLine=$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens

Details:

CommandInvocation(Add-Type): "Add-Type"

ParameterBinding(Add-Type): name="AssemblyName"; value="System.Windows.Forms"

under PowerShell > Operational, there are Verbose events that say "OutputEncoding = [SystemConsole] InputEncoding [System Text Encoding] UTF8; Get-CimInstance win32 VideoController", as well as others that say 'WmiMonitorConnection' instead.

other Verbose events say this: "gp HKLM/System/ControlSet001/Control/Class/[folder with Monitor connection keys] -ErrorAction SilentlyContinue | where MatchingDeviceId null -NE | select MatchingDeviceID, HardwareInformation qwMemorySize | fl"

there were then Verbose events that listed the Cim commands like Get-CimInstance, Invoke-CimMethod, Get-CimClass, Remove-CimInstance etc. etc.

now I do want to say that this appears to be related heavily to my actual Discord account. I have tested with a fresh Discord installation on my laptop, and signed into my account before doing the exact same logout > login > restart app process

when doing that on my laptop, these exact same events were logged into Event Viewer. I even reinstalled Discord and these events still occurred; I also started the application as Administrator but it did not change anything

the peculiar part is that I then tried to sign onto an alt account to test this as well; the alt was completely new and I joined a few servers to replicate my main account as much as possible. I then did the log out > log in > restart steps but the events did NOT occur or log when performed on this alt Discord account

I asked both of my friends to do this as well and they do not have any new PowerShell events in Event Viewer. due to the fact that these are logged across 2 devices but only on the same account leads me to believe my Discord account is responsible; however, I want to get some insight from the PowerShell-side of things

what are these events doing? by the sounds of it, and the Registry pathway, it seems like Discord is invoking PowerShell to query my monitor, GPU, drivers, and general hardware information?