The cleanup and compact operations on queryable encryption collections are internally renaming and then recreating the ECOC collection.

Since the ECOC collection lock is released at the end of the rename and reacquired at the beginning of the create, in presence of concurrent user insert/update it is likely for the collection to be implicitly created: writes would serialize on the collection lock behind the rename and happen right when it is released, sneaking in before the create.

That can be problematic in sharded clusters because the QE main collection (not the state collections) may not fully reside on the db primary shard because any user write is translated into an internal transaction and the implicit creation of the ECOC collection may fail because not supported in distributed transactions.