What can be done so that working devices with secureboot working and reporting everything in all other Intune features are seen as certificate status unknown and nothing in trust/confidence etc in the secureboot report.

We have about a 3rd of devices in that situation

Device are the 1801 events