The after can contain an unexpected null value when capture.mode.full.upde.type is set to lookup and the document was removed (in some way) before the lookup takes place.

This can happen in two scenarios

1) Consecutive update-delete
Generally known, however it should likely be documented explcitly

2) Updating a property which is part of the sharding key
Based on user findings, when property which is part of the sharding key is updated Mongo might move that document to a different shard. In such cases the lookup might also fail to locate the document. Resulting in null value for fullDocument (and thus DBZ's after filed).