I have Windows server subscribing to a windows log event forwarder.  I have noticed that some events that appear within the forwarded event log are not ingested by NX Log and forwarded to the SIEM platform.  eg 

event id 1102 and 22

both events are forwarded from the source servers to the windows forwarded where nx log is running so windows upload is fine, just nxlog sending on to SIEM