All EDR software does (at least on macos)

Source: me, a developer who also codes in free time and notices how bad fs perf is especially.

I've had the CrowdStrike sensor, and my current company is using cyberhaven.

So.. while 2 data points don't technically make a pattern, it does begin to raise suspicion.