The issue seems to be in udevadm, the systemd-resolved command could just be used to “fix” the issue". Unfortunately, while running udevadm trigger --settle sometimes, running udevadm trigger --settle --debug would never reproduce the issue.
Ultimately though, we can simply not have software that chooses to automatically update itself or run commands on systems like this in our environment, so snapd is masked now and that’s the end of where I can investigate.