These "non-audit" events appear in the security but are not produced by any of the standard audit policies. These events are logged even if you disable all auditing. All of these events report EventLog as the source.