Now I've narrowed down when it happens, I'll take a bunch of screenshots and document the next update, in case it happens again.

I have the firewall set very aggressively, so it checks on everything the first time it happens (including things like things like "mojo.exe is trying to modify the user interface of Wow.exe"). I have told it to treat Mojo as a trusted application and Mojo's updater as an installation program, but it doesn't seem to stick between updates. I'm guessing this is a symptom of this ClickOnce software you mentioned before, but its not an educated guess.