Why do you disable the systemd-sysctl service altogether?
As far as I know only the following sysctl is incompatible:
```
     # Hide kernel pointers (e.g. in /proc/modules) for unprivileged
     # users as these make it easier to exploit kernel vulnerabilities.
-    boot.kernel.sysctl."kernel.kptr_restrict" = 1;
+    #boot.kernel.sysctl."kernel.kptr_restrict" = 1;
```
... since it appears that the kptr_restrict no longer exists under a grsec kernel (not sure under what exact circumstances).

Maybe we can just disable this option if grsec is enabled?