@Stephen Mattern , In general, Intune will install the Intune Management extension on the device if a PowerShell script or a Win32 app is targeted to the user or device. And only win32 app and Powershell script will installed via IME.
https://learn.microsoft.com/en-us/mem/intune/apps/apps-win32-add
Before going on, I would like to confirm if the Watchguard Mobile VPN installation and company portal apps are deployed via Intune win32 app.
For the BITS job, it seems the windowsagent.msi is not downloaded. Here we suggests to manually access the URL "https://approdimedatapri.azureedge.net/IntuneWindowsAgent.msi" to see if it can be downloaded.
If there's any update, feel free to let us know.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.