I know you have an 0411 so you aren't using EEHack, but I noticed--and confirmed from reports from at least as far back as 2017--that when EEHack has a communication error, it tends to show knock counts where there may be none. Just throwing it out there that the knock counts may actually be intermittent communications errors with whatever scanner you're using? Unless the scanner is actually pulling knock counts from a specific location in memory where the PCM itself is saving them, it's possible that these are false counts.