Hello @maddog,
I just did some testing and yes, as soon as someone enters your Waiting Room they are consisted connected to your session and thus the 40 minute timer is initiated.
If you want to prevent this from happening, you would need to "lock" the meeting from the Security button in your zoom client. This will prevent any one else from connecting to your MeetingID until you unlock it again.

The other solution would be upgrading to a paid license. With a paid license you would not have a 40 minute limit regardless of how many people are in your meeting or waiting room (up to 100 connections).
If this has answered your question, please click the Accept as Solution button below so that others in the Community may benefit as well.
Thanks!