The viewer converts the format file being viewed to "Kovid Goyal's universal format", and it does that in the calibre cache directory. You can relocate it via the CALIBRE_CACHE_DIRECTORY
Environment variable. Might be an idea to monitor what's going on within it.
What happens if you make a minor change to the epub content (i.e. the text , not the markup) - that should trigger the 'first read' process.
I doubt it will be anything to do with Defender, too many people use it without any troubles.
BR