The upstream ComponentDetection application emits the locationsFoundAt paths in URL-encoded form. Where a path includes spaces, this makes the paths in componentsFound.locationsFoundAt and those in dependencyGraphs differ. For example:

{
  "dependencyGraphs": {
    "C:\\src\\my project\\my project.csproj": {
      ...
    }
  },
  "componentsFound": [
    {
      "locationsFoundAt": [
        "/my%20project/my%20project.csproj"
      ],
      ...
    }
  ]
}

Since these don't match, the manifest isn't found and I get a bunch of warnings like

 Warning: No dependency graph entry found for manifest location: my%20project/my%20project.csproj

and the dependencies aren't recognised.

I have reported a bug upstream (microsoft/component-detection#1476), but in the meantime it should be relatively straightforward to address this behaviour here