This issue does not appear at random. It happens when the value is reset upon a detection and the Damage Cleanup Engine doing its work. It occurs as per product design.

The behavior is defined by the parameter "RemoteRegistry=1" in AMSP TSC.ini file located at C:\Program Files\Trend Micro\AMSP\module\10002\*. Setting this value to "0" will not interrupt HKLM\SYSTEM\CurrentControlSet\services\RemoteRegistry.

However, there is no feature to configure this via Deep Security Manager (DSM) console. If you wish to have this functionality, please open a feature request.