Sonarr itself needs to run as Administrator once so it can adjust http urlacl (just run as admin once, then stop it again). Sonarr uses the .net framework http subsystem which in turn uses a windows mechanism that managed permissions on which urls an app can be hosted under. Sonarr needs to reserve ‘http://*:8989’. Consider it a mechanism that verifies who can sell lemonade in front of your house.
The existing reservations can be seen by running ‘netsh show urlacl’. The same cmdline tool can be used to add the appropriate reservations, but Sonarr will do that for you if it runs as Admin.