LogonSessionId account assigned Read access in new certificates?
It's because you have different scopes.When you add something at the machine level, by default it gives all users read permissions. Everyone with access to that computer will be able to see the certificate.You don't need to explicitly give users read access for a machine level certificate.It's like when you install some programs they ask "Install for all users?" If you say yes, it installs at the machine level and everyone can use it, otherwise it will install for just you and logging in with a different user means they won't have access.
Comment out the user-specific part of your script to test what I'm saying, you'll notice all users are given read-only and things will work as expected.