Can you raise a support case? It should not be possible to do this.
They will need to look into the system state to assess what is happening.
The problem was, that we had the svchost.exe in an updater rule. After we have checked the rule and removed svchost.exe., it is no longer possible to change the registry values over remote access.