The setting "Scan processes on service startup and content update" is enabled in the Endpoint Security Threat Prevention, On-Access Scan policy. Potentially Unwanted Program detections still happen during normal on-access scanning (OAS) even though you excluded the Potentially Unwanted Program by detection name in the Endpoint Security Threat Prevention, Options policy. By default the setting "Scan processes on service startup and content update" is disabled as it can be impactful, depending on workloads, to the overall perceived performance of a system.