I don't get false positives on the disabled internal monitor, but do get false positives for signatures not being up to date. I haven't managed to pin it down but I think it occurs when devices like laptops are offline but running. when they reconnect the agent connects to LT and the monitor fires. Moments later the AV updates.
Is it possible something in your AV disables the AV for a minute while it updates? You could increase the monitor count to, say, 3 and see if that cures the issue. If the AV is really disabled, it will be disabled for several minutes - enough time for the monitor to fire a few times.