An Ansible playbook reports changed on every run

The team standardizes access ports on 40 Catalyst 9300 switches with a playbook that uses cisco.ios.ios_config. A nightly job runs it in check mode as a compliance report. Every night it says all 40 switches would change, even straight after a real run that succeeded. People have started ignoring the report. The task looks like this:

- name: Standard printer port
  cisco.ios.ios_config:
    parents: interface GigabitEthernet1/0/10
    lines:
      - desc PRINTER-2F
      - switchport mode access
      - switchport access vlan 20
      - spanning-tree portfast
      - no shutdown