Long story short I changed the Default Domain GPO (stupid I know) so that only Administrators had the Manage auditing and security log right under Computer Configuration > Security Settings > Local ...