I found that if I ran on a RT kernel that I didn't see this behavior at all, or at the very least it deminished it.
ES_OUT_SET_(GROUP_)PCR is called too late