KB5020044 Fixes Process Creation Audit Logging (Event ID 4688/1108 Issue
The 1108 events should stop after updating to 22621.900. The 4688 (Process creation event) entries appear correctly now.
From November 29, 2022—KB5020044 (OS Build 22621.900) Preview:
Improvements
"It addresses an issue that affects process creation. It fails to create security audits for it and other related audit events."