@BootyBoothin suggestion for marathontimer, being able to see the logs of time added and their source (if possible). In case of any doubt we would have a way to compare.
@NiklasTinner hi, maybe you can help, we are using your uload hardware hash to intune and since about 2 weeks. Our techs are getting "need admin approval" window. thanks.