If I run

journalctl -fb

in the VM, I keep seeing containerd messages that mounts have been deactivated successfully - which strikes me as unusual.... but without knowing details it might be working as designed. Looks to always be related to the same 2 k8s IDs. It (systemd) also keeps creating and ending sessions, which I guess is related.