Something I realized, you’re querying the process_events table but you need to enable events for that table too with

audit_allow_process_events