@jsu You're not going crazy or alone in this. This is common currently so far Windows, Mac and Linux "CentOS 8" all do the same thing. "Multi none linked cluster setup same results"
Seems to be a random missed check in. If you check the endpoint logs you should see it saying the kibana instance your trying to connect to is offline at that time. It's clearly not offline as other agents will check in at the time. It is far better in 7.9.1 then it was in 7.9.0.
Security - Administrator I get the same thing not sure this is the intended function...
Endpoint is in a rough state in 7.9.x but it's getting better...
The logs are under logs-elastic.agent-* and metrics-elastic.agent.* with the metrics having one for endpoint. It makes about zero logical sense when your looking for it it based on the integration name. I looked at is as Windows would be under Windows and Cisco would be under Cisco so maybe Endpoint would be under Endpoint. Nope...