Are those groups maybe set for Zero Drift?

Yes. They were. Disabling Zero Drift fixed the issu for me. Thank you. I guess I'm starting to understand that feature now. :)

Good to know. And this tells us the docs can be clearer. “NeuVector will scream at you in ZD mode about anything that wasn’t shipped with an image it assumes you hardened. You have been warned.” or something like that. 😄

The docs are pretty explicit that it will alert in monitor and discover and block/alert in protect. From the release notes and from https://open-docs.neuvector.com/policy/processrules