This is likely the result of a persistent WMI attack.
Download Autoruns (https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns), and fire it up. Click the WMI tab, and check for something in there. It would look like an SQL query that would return a result if more than 300 seconds had passed since the last time the event fired. The command that it fires on the machine I found it on used Powershell to grab some trash off of Pastebin and execute it. Anywho, right-click > Delete. Scan your machine for any files that might be left over (if you're anything like me, you may have a crypto miner in your System32\config\systemprofile folder), and enjoy the sweet silence from Windows Defender.