That is bizzarre!
Running on the same ESXi host (so that means the microcode is present and active in the host hardware), OK for 2 VMs but not the DC VM. Running on same ESXi host also precludes the /etc/vmware/config mask from the "Intel Sightings" KB as the culprit.
How about the DC VM hardware compatibility setting? Is it also version 13 (supported by ESXi 6.5) or at least same as the TS/Exchange VMs? I think the recommended minimum is version 9.
Other than HW compability version, I can't think of any other possible reason why. But the fact the stibp, ipbp, and ibrs capabilities show up in the vmware.log that means the ESXi hypervisor found the microcode update and should be exposed to the VM.
Alternatively, you could remove those registry settings; because those registry settings were really introduced to mitigate the crashing in January (just like the VMware Intel Sightings KB).
