Is it the two _wait_for_s in AuditdNetlink::getEvents() and AuditdNetlinkParser::start() that have a maximum time of 1 second each?

and then will proceed processing them

Do you mean that _AuditEventPublisher::run()_‘s call of AuditdNetlink::getEvents() will be done by then and it will move on to AuditEventPublisher::ProcessEvents() ? https://github.com/osquery/osquery/blob/e6fe15eb49660725e65dba1549932ed96e0a8c6e/osquery/events/linux/auditeventpublisher.cpp#L94