You are spot on. Parental Controls on Mac works only if you have a fresh installation of Mac OS X, and have not installed a single other non-Apple application. Reason being is that virtually all applications today install background services that ping various servers/websites (nothing nefarious; just the usual things apps must do to work properly, such as connect to AWS to poll various data, call home to authenticate registration, etc.). The Parental Control service then sees all of those pings simply as, "Your kid is trying to access http://adoberegistration.services.authentiocationservice224.com. Do you wish to allow?"
Adobe applications (Creative Cloud, e.g.) are notorious for this. They install at the root/admin level, so that even when your son, with a restricted account, logs in you will spend the next 20 minutes of your life authenticating with the "Always Allow..." dialog. And that only applies for that session. If he/she logs out and logs back in, you will repeat this nearly endless process.
Then have fun tracking down and disabling the guilty apps/services! If you're successful, the unintended consequence is that when you need to go do serious adult work in any Adobe app, all the necessary services will have been shut down.
Although this isn't necessarily Apple's fault, they sure don't provide any wizards/help in trying to make life any easier for you and your kid(s).