Thanks!You may have just leftover Windows ESPs. Those are also critical, when it comes to unprotected UEFI Windows boots.
Such a boot loader can inject certificates, even when there is no Windows installation on same medium. As of a deleted, former Windows installation.
You should check your firmware for certificates, and use the [check ESPs for Microsoft certificates] tool of the Dumper package to scan your Mac for Windows boot loaders (ESPs).
Dumper link is in my signature.
Too bad I don't have macOS installed on my MacPro5,1 anymore. Was planning to move away from that computer since my son is using it mostly and mainly for gaming.