I’m hoping @mari0d has more input here.

Most likely we have overly broad audit rules - was hoping to hear from someone else that my have experienced this issue and just whitelisted the osqueryd process.