I recommend go to local policy and enable full audit for everything. When this happens in the future you'll have a clear picture of who/when/what.
I completely stopped using windows in the 8.1 days (forced telemetry was the last straw). I can't imagine dealing with the sorts of gaslighting you are experiencing.
Happily, a combination of steam proton and dosbox run dos / windows games on my Linux desktop more smoothly than native ever did, and that was my last missing use case.