Turns out when PhpStorm was installed, that it replaced the native "ps" command on Mac to launch their own program. Removed the symlink in /usr/bin and this cleared up. Below was the log file from Tinkerwell that tipped me off to the cause.
Looks like horizon may also use "ps" to check if it has an existing running process.
[2020-12-01 10:26:47.794] [info] Downloading update from Tinkerwell-2.11.0-mac.zip, Tinkerwell-2.11.0.dmg
[2020-12-01 10:26:48.202] [info] Update has already been downloaded to tinkerwell-updater/pending/Tinkerwell-2.11.0-mac.zip).
[2020-12-01 10:26:48.286] [info] / requested
[2020-12-01 10:26:48.292] [info] /1606836408204-8472.zip requested
[2020-12-01 10:26:48.293] [info] /1606836408204-8472.zip requested by Squirrel.Mac, pipe tinkerwell-updater/pending/Tinkerwell-2.11.0-mac.zip
[2020-12-01 10:26:53.987] [info] Proxy server for native Squirrel.Mac is closed (was started to download Tinkerwell-2.11.0-mac.zip)
[2020-12-02 11:32:46.094] [error] {
constructor: 'Error',
killed: false,
code: 1,
signal: null,
cmd: 'ps ax -ww -o pid,ppid,uid,gid,args',
stack: 'Error: Command failed: ps ax -ww -o pid,ppid,uid,gid,args\n' +
'\n' +
' at ChildProcess.exithandler (child_process.js:308:12)\n' +
' at ChildProcess.emit (events.js:203:13)\n' +
' at ChildProcess.EventEmitter.emit (domain.js:476:20)\n' +
' at maybeClose (internal/child_process.js:1021:16)\n' +
' at Socket.<anonymous> (internal/child_process.js:430:11)\n' +
' at Socket.emit (events.js:203:13)\n' +
' at Socket.EventEmitter.emit (domain.js:476:20)\n' +
' at Pipe.<anonymous> (net.js:588:12)'
}