Are you intentionally using ZESM and its policies?  If not, I would recommend configuring ZENworks to remove those services.  If you are, you likely need a service request because debugging via the forums would be impossible.  How to remove/disable if not used would be easy most of the time.

Back in 2019, I enabled ZES and entered a product license key.  In 2020, during a migration, I entered a new key.  But nothing in my documentation is telling me if I am actually using any of the ZES features.  Is there an easy way to determine that?  I don't want to disable it and make things worse.

Run "MSINFO32" and look for installed device drivers....If anything starts with a "Z" you likely have ZESM components installed.

If you are not intentionally using ZESM, make sure you set set to "Location Lite" which does not use ZESM Drivers.  Full Location Awareness uses drivers, but the only thing it adds if the ability to use an SSID for locations.  

zesdac, zesfsmf, zesfw, zesnetaccess, and zeswifi are all listed.  I also have ZESM enabled and full location awareness selected.  But I am trying to figure out if there is anything that would get messed up if I switched those off.  At one time, I had a MS Data Encryption Policy enabled, but it is not currently applied to anything.  I assume it would be affected by this change.  Anything else?

These are the list of policies that could be impacted.

Note: Despite Antimalware Policies being listed under ZESM, they would not be impacted.  They have no requirement for ZESM to be installed on the agent.  ZESM only needs to be licensed in the Zone.