First thing, I'd suggest updating your connectors. I think we already addressed this in a new connector revision for Windows Security events.
If that doesn't work, you'll need to work with Support so they can get the dev team involved to re-write how the connector normalizes the data.