Control Tower Issues Are they common?

Yes, the issues you're encountering with AWS Control Tower are relatively common challenges that many organizations face during setup and maintenance of their landing zones.

For your first issue with the log-archive account lacking S3 access permissions, this is a known problem. When configuring Control Tower landing zone, S3 buckets like "aws-controltower-logs-" and "aws-controltower-s3-access-logs-" are created in the log archive account. Your workaround of temporarily disabling logging and then re-enabling it is a valid approach to resolve this permission issue.

Regarding the "no launch paths found" error with Account Factory, this is often related to governance drift in AWS Control Tower. Drift occurs when changes are made outside of Control Tower that affect its managed resources. Your solution of updating the landing zone without changes is a correct approach to resynchronize Control Tower with the current state of your AWS organization.

The permission denied errors in CloudTrail and S3 bucket policy issues are also common. AWS Control Tower implements strict security controls by default, and sometimes these controls can be too restrictive for certain operational needs. Moving the account to a different OU temporarily to fix the bucket policy is a creative workaround. The drift you're experiencing now is expected since you've modified resources that Control Tower manages.

It's not uncommon to need to adjust SCPs (Service Control Policies) when Control Tower's default policies are too restrictive for your specific use cases. Many organizations find they need to customize these policies to balance security requirements with operational needs.

To resolve the current drift, you might need to re-register the OU or update the landing zone. For ongoing management, consider planning your Control Tower implementation with these potential issues in mind, and establish processes for handling drift when it occurs.
Sources
Troubleshooting - AWS Control Tower
Control Tower Fails by S3 access | AWS re:Post
Control Tower set up landing zone problem | AWS re:Post
Types of governance drift - AWS Control Tower

Aside from the questions what I did so far to resolve is the following:

1. Account factory could not find the "Landing Path" I simply updated control tower (No actual updates) but typically done to correct dirift. This fixed our account factory problem.
2. For Cloud Trails not being able to log to the Control S3 bucket, I simply created a break glass OU (No SCP's applied) moved our log-archive account this ou. Switched to the log-archive user, navigated to the s3 bucket and selected the "Fix Bucket policy" once this was done Trails started logging to the bucket. Finished up by moving the log-archive account back the security ou
3. Once all that is done it will create a DRIFT on the security OU (SCP policy being different then the Bucket policy) I updated the SCP to reflect the bucket changes and now the security ou is back in a compliant state