Technical issues require accurate technical responses ... even if cross-talked.
Example: this 'Extracting backup file to \folder\etc.' ... are we then to asume that \folder\ was c:\pathto\moodledata\temp\backup\
I can tolerate a little Window's speak!
If attempting from command line, php should be using php-cli ... and not the php used for the web service.
So what does php -v from C:\anywhereinmoodlecodedirctory show? In Windows you might have to use php-cli.exe and the full path to php-cli.exe ... c:\php\7.3\bin\php-cli.exe ... something like that.
So it started that ... regardless if it finished or not .... what did it do in there? What files/folders were created? A typical functioning system does create a .log file in there (they call steps in a 'plan') and that .log file does show values for a plan step in restore. Successful restores the log show 1000 ... unsuccessful restores something less. Plus, it's the web server user executing php scripts so the ownerships/permissions come into play in that \temp\backup\ It's not unusual for mistaken ownerships/permissions not given recursively.
Recyclebin applies to deletion of a module in a course or a deletion of a course or category. Don't think it's involved in restore.
Cron job and task are being performed as you do a restore if cron set to execute once per minute. There are 'clean up' task .... one involves clean up of \temp\ in moodle which would include the folder where restore is using to un-compress .mbz files.
Supposedly, locks are created which would prevent cleanup from erasing restore directories/folders.
max_allowed_packet applies to MySQL/MariaDB ..
https://dev.mysql.com/doc/refman/5.7/en/packet-too-large.html
What you need is a Windows expert ... how about it Windows folks! Jump in here!
'SoS', Ken