rootupd.exe was run before the installation and this didn't resolve the issue.
SISAgentSetup.log contains the following errors
MSI (s) (10:4C) [15:39:33:189]: Invoking remote custom action. DLL: C:\windows\Installer\MSIF3FF.tmp, Entrypoint: EFAInstall
EFAINST_TRACE [15:39:33:236]: --> Starting ValidateCurrentProcess...
EFAINST_TRACE [15:39:33:267]: ValidateCurrentProcess (86) - Initializing verify trust...
EFAINST_TRACE [15:39:33:315]: ValidateCurrentProcess (103) - Get current process info...
EFAINST_TRACE [15:39:33:346]: ValidateCurrentProcess (107) - Check process path...
EFAINST_TRACE [15:39:33:377]: ValidateCurrentProcess (127) - Validate process path...
EFAINST_TRACE [15:39:33:986]: ValidateCurrentProcess (132) - Verify couldn't successfully validate process id: 7084 for 4 signature. ccVTErrorType = 3
EFAINST_TRACE [15:39:34:017]: <-- ValidateCurrentProcess ended
CustomAction efainst_install.C1599C28_9DB3_446E_AC61_80DD180FF696 returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
Action ended 15:39:34: InstallExecute. Return value 3.
Release : 7.0.x, 7.2.x below build 7.2.0.265
Component : SYMEFA
Known issue resolved in the newer CSP agent build
Install Critical System Protection (CSP) agent build 7.2.0.265 or newer.