Have 3 servers (R770 and R650) reporting TPM-WMI 1801 every 12 hours.

"Secure Boot certificates have been updated but are not yet applied to the device firmware. Review the published guidance to complete the update and ensure full protection. This device signature information is included here.
DeviceAttributes: FirmwareManufacturer:Dell Inc.;FirmwareVersion:1.19.2;OEMManufacturerName:Dell Inc.;OEMModelSKU:SKU=0912;ModelName=PowerEdge R650;OSArchitecture:amd64;
BucketId: 19ed8480256ad5f89388190863edace6129ee87452ae9fc33d012d90ee080b78
BucketConfidenceLevel: Under Observation - More Data Needed
UpdateType: 
For more information, please see https://go.microsoft.com/fwlink/?linkid=2301018."

Those servers had their BIOS updated as part of the Secure Boot key updates, after applying the new keys they were fine (1808) but started reporting 1801 again about a month ago.  One of the R750's had the BIOS updated to 1.21 and still does the same/

Followed the instructions here and after several reboots still reports 1801.

In all of them when you run Get-UEFICertificate the PK expires 4/28/2035, the KEK expires 3/2/2038 and DB key expires 6/13/2038.  

Have any of you experienced this?  Opened a support ticket but haven't been contacted yet, if this continues will go ahead and turn off secure boot as a last resort on the next maintenance window.

Just on case, the R750's run Windows Server 2019 and the R650 Windows Server 2025.