When I use Fiddler I see 2 calls to the tracking agent files, one returns 401 HTTP status code and the second returns 200 HTTP status code

The tracking agent sends data to the Event Collector web application. The CardioLogAgent IIS virtual directory (aka, the usage tracking application) requires user authentication, and thus is set to Windows Authentication. Just like any SharePoint page request, a request for a CardioLog Agent resource (including JS files) requires user authentication. Therefore the response includes a WWW-Authenticate header field containing a challenge applicable to the requested resource. The client then repeats the request with a suitable Authorization header field.