Yes, that's are my actual settings and keeping them with KTS2016MR1.
I'm not getting that issue. Maybe some new applications are moved to Low/High Restriction the 1st time I run it (thing that We could find logical as I don't trust signed applications), but once I move them to Trusted, they do not go back to Low/High Restriction group anymore.
If I was getting Your issue It would be impossible to work with my system everyday

but not my case.
I know that sometimes could be a temporal issue with trusted rules/or maybe a problem from KSN, but I got it rarely, I really can't remember now when was the last time that some trusted applications were moved to restrictions groups automatically... many months, and as I know, maybe the problem was a temporal issue with KSN.