How ı find more info about

why rundll32 .exe sandboxed ?

Check the auto-containment event log and look under contained by column. If it says containment process that means a process that was running in containment started rundll32 which in turn caused it to be run in containment.