Change Auditor is not consistently auditing all Active Directory events, especially user or group changes.
The Change Auditor Coordinator does not seem to be auditing all user or group changes. This has been confirmed with 'Critical Group membership changed' events being audited but not 'non-critical group membership and user changes'.
The Coordinator config was imported from another installation which corrupted the Active Directory auditing template.
Select the Administration Tasks tab | Auditing | Active Directory
Delete the default Active Directory Enterprise auditing template
Add a new Active Directory Enterprise auditing template