‘Critical’ Security Measures keep reverting

I’m running several WP sites on Cpanel and managing WP and the plugins using WordPress Toolkit.
After installing WP-Optimize I get alerted of a security vulnerability for ‘Restrict access to files and directories’.
I let the toolkit remediate the issue, but the next time I check, it is vulnerable again with the same issue.
The remediation does the following: “This security measure sets the permissions for the wp-config file to 600, for other files to 644, and for directories to 755.”
I can only assume WP-Optimize is using a directory or something that makes WP Toolkit complain? I can’t find any directory that has the offending permissions. Everything else runs fine without issue; just worried about security.