Thanks Thomas. I found it after reading what you said, it's the DAS Role
Update Utility and it removes the built-in/admins group from the COM roles.
This doesn't stop anyone from adding themselves to the mom admins group
though but it's a good start.