Event 1801 TPM-WMI even though all 2023 CAs are present.

Hello,

I have here HP EliteDesk 800 G5 Tower(s) running Windows 10 22H2 (19045.7291) that had not yet received the Windows Secure Boot certificates.
I performed a BIOS update to version 02.25.00 Rev.A and loaded defaults settings.

Then:
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot /v AvailableUpdates /t REG_DWORD /d 0x1844 /f

followed by: schtasks /run /tn "\Microsoft\Windows\PI\Secure-Boot-Update"

After a reboot, I can see that Microsoft Corporation KEK 2K CA 2023, Windows UEFI CA 2023, Microsoft UEFI CA 2023, and Microsoft Option ROM UEFI CA 2023 are all set to "True" according to PS Get-SecureBootUEFI (db and KEK).
However, PS Get-SecureBootUEFI dbDefault and KEKDefault still show as false, but I assume that’s correct since those certificates are not in the BIOS defaults - right?

BUT... I am still getting the Event 1801 TPM-WMI error in the event log after every Windows startup.
BucketConfidenceLevel: Under Observation - More Data Needed

Is this because I haven’t replaced the boot manager yet (by omitting 0x0100 from the registry key)?
Or do Microsoft (and HP?) first need to approve the use of the new certificates on this certain machines before they are actually used?

Thanks for any advice!
Best regards, Martin