drop KillMode=process
    
    MariaDB-10.4 onwards included a pam_helper subprocess to help
    with the pam authentication module.
    
    If the user is running with Galera there are SST modules that could
    be executing.
    
    By dropping KillMode=process this reverts back to control-group to
    cover all of these subprocesses. This is what upstream does.
    
    https://jira.mariadb.org/browse/MDEV-25233 suggests moving to
    KillMode=mixed, which is probably ok too, but has been tested less.