NPE gets updated occasionally to help handle different threats or to make the operation better. This could explain why you are seeing different behaviours from the past.
It sounds like you do seem to have a handle on how Windows works, but it is not recommended to run NPE unless normal scans with NIS/NAV/360 show there is a problem that they cannot handle. NPE can actually flag a critical Windows System file for deletion, and if the user does not know what the file is and allows NPE to remove it, the system can become unbootable.
An example of that is the driver files that were found by one of your scans. If you understand what they are, you know whether it is safe to remove them, or if they are false positives from the NPE scan.
I'll leave your root sector questions to those with experience in that area.