[Defender Pro] Suspicious files removed by Defender keep reappearing

Defender file scan of core and plugins finds suspicious files quickly. Scanning for suspicious code is very slow and often freezes around 30%. Defender removes two suspicious files and they reappear within minutes. I’ve used another malware remover to confirm dodgy files have been removed.

/var/web/site/public_html/wp-admin/601b3006b052411f7eaa9a14103d1103

/var/web/site/public_html/wp-admin/network/601b3006b052411f7eaa9a14103d1103

Each file has one line of characters, like an API key but not sure what it’s for.
I’ve applied all the security tweaks in defender. I’ve removed a lot of unused plugins. I’ve added IP bans and 2FA auth on users. The site is hosted on WPMU and is multisite.

How else can I stop this happening?