Its a known issue, Upgrade to SEP 12.1.2 for the permanent fix
Old definitions require a reboot in order to be removed
Fix ID: 2692127
Symptom: Old definitions appear to require a reboot in order to be removed. This is usually due to a scan running at the time of the update.
Solution: Updated the Common Client component to resolve a condition where the scanner held the virus definitions open, which prevented an update.
Source: