This is a limitation of the Windows SMB service.
The process information is only available when the changes are made locally.
When remote changes are being made the Windows SMB does not transmit the name of the origin process, thus Change Auditor is not able to report on it.