Sorry, I don't think that combining both will make a difference.
Maybe TS does reset the counters for all cores in multiple loops to somehow trick Defender into believing they don't work, so it won't use them.
Moreover, it's interesting why Defender sets the counters to measure only kernel occupancy (CPL=0). Maybe there's a reason for this - the realtime protection checks if specific processes execute also tasks in kernel. So disabling this feature might reduce its capability to detect some threats...