The OOM killer always, invariably starts off with killing the display server. Any side effects such as “the notification daemon loses its connection and closes” or “every single thing that you were working on loses its connection and closes” is incidental.
At least Windows has more precise monitoring, it will tell you whether the process is “Windows Telemetry” or “SVCHOST.EXE”.