Could it be that the Log Forwarder for Windows forgets to send the Windows Event ID number to the Syslog server?
Please send me a private message. We've got a release candidate for a new version that resolves this issue.