I had the idea to use different log files for the three profiles.
The reason is, that the server 2019 has two interfaces, one has domain profile assigned, the other has public profile.
It showed up, that in the log for domain profile only ALLOW events for connections on the interface with domain profile are logged, but no DROP events.
After some research I found the missing DROP events in the log file of the public profile.
Any idea why?