I am still getting used to medium comment hierarchy. So, reposting my responses at this level.

I have validated the audit logs in multiple places outside my organization and it has worked fine, I am suspecting something to do with Azure AD setup. Test decoding your access token and see the content using https://jwt.io Look at "upn" or "unique_name" properites in the decoded token, if they show GUID instead of names it would be an indicator that Azure AD setup is causing this to happen.

Which timezone are you located, maybe I can look over your environment on Friday.