(resolved) HTTP error 503: Service Unavailable

My app pool keeps dying on me and after 5 tries I think it gets disabled.

From event log, source WAS:

A worker process with process id of '1504' serving application pool 'PowerShell Universal' was shutdown due to inactivity.  Application Pool timeout configuration was set to 20 minutes.  A new worker process will be started when needed.
A process serving application pool 'PowerShell Universal' terminated unexpectedly. The process id was '1504'. The process exit code was '0xe0434352'.
The Windows Process Activation Service failed to create a worker process for the application pool 'PowerShell Universal'. The data field contains the error number.
The Windows Process Activation Service failed to create a worker process for the application pool 'PowerShell Universal'. The data field contains the error number.    
Application pool 'PowerShell Universal' is being automatically disabled due to a series of failures in the process(es) serving that application pool.

This is all I get in logs:

2020-07-15T23:38:00.5500922+01:00  [INF] Old jobs: 0 (be620771)
2020-07-15T23:38:00.5501052+01:00  [INF] Finished groom job. (ccb4f234)
2020-07-15T23:38:50.3882114+01:00  [INF] Application is shutting down... (90f52c38)
2020-07-15T23:38:50.4104935+01:00  [WRN] Exception during stop. (69827b32)
System.NullReferenceException: Object reference not set to an instance of an object.
at Universal.Server.Services.SecurityProxy.StopAsync() in 
C:\src\universal\src\Universal.Server\Services\SecurityProxy.cs:line 77

Server 2016, IIS 10.0, PSU 1.2.8
I upgraded from 1.2.4 as it had the same problem, but update didn’t help
Pretty much fresh install

web.config:

<aspNetCore processPath="C:\PowerShell\Universal\Universal.Server.exe" arguments="" forwardWindowsAuthToken="false" stdoutLogEnabled="true" stdoutLogFile="C:\PowerShell\UniversalProgramData\logs\log" hostingModel="InProcess" />

Any ideas?

edit: “Log on as Batch Job” permissions are set in GPO?
I would rather prefer to run IIS worker as “Network Service”, but I don’t want to lose credential store that I get with domain user.

edit2: ok I went into secpol.msc > Local Policies > User Rights Assignment and added domain user in all permissions where I saw IISAppPool defaults (bottom of the page in this doc).
Restarted apppool and IIS now, hopefully it holds

edit3: ok it looks like it might have been a permission issue after all, it’s been 20 minutes and I am not getting any more errors in event log so far. Will continue to monitor event log for errors.