Events set to dontaudit need to happen after running semodule --DB for them to appear on the audit log. Running the failing commands again would trigger these events.