When something like this happens, I'd start with the HW, then Windows, then the app causing the problem.
So is the baremetal firmware ie your laptop all up to date, like bios, hd controllers, usb controllers, Intel ME if its an Intel CPU, TPM?
Why? Here's an example of how to make malware on firmware persistent so it doesnt matter how many times you reinstall windows! Sprites mods - Hard disk hacking - Persistence
Its also worth checking your TPM is upto date and for any bug which cant be fixed. If its out of date or buggy, I disable it in the BIOS and let windows do the heavy lifting instead of the TPM chip. Windows will emulate so at least you are upto date by using windows. Obviously entropy will vary though and other risks present themselves, so the call disable the TPM in BIOS is personal.
Then check Windows OS is all up to date, so for Win10: Settings, Update & Security, Windows Update, Advanced Options.
On - Receive updates for other MS products
This way all your MS software bases are covered, even if you dont have Office installed, there's plenty of other MS non OS software installed in mosts use cases unless you are corporate.
Then check the logs for VMware. You can always post them on here, but no guarantee anyone will look at them as this is the charitable section of VMware. 🙂 The VM logs are fairly intuitive, so scanning them can hilight quickly and easily where the problem is.
When posting logs, it pays to remove any identifiable data for a variety of reasons. There are so many ways to track people with web browsers one example as noted by this white paper solomos-ndss21.pdf (uic.edu) and if interested here is how you can nick someone's AES key from a military grade chip in 0.01 seconds, but it does require physical access but fortunately not alot of time to do, so something the office cleaners could be adept at. In the blink of an eye: There goes your AES key (cam.ac.uk)
Anyway good luck.
