Do you sign your executable? I have seen instances where high UPX compression can trigger an AV response because it thinks the code is obfuscated.
No, I don't. They're exported straight from GameMaker and don't go through any changes before uploading to itch.