Description of problem:
It was found that pam_faillock is making bad audit events. Seems to be this way a while. But recently found that it can mislead ausearch to associate the wrong name to uid. The fix is to change uid to suid. There is a patch here that upstream recently accepted:

https://github.com/linux-pam/linux-pam/pull/591

This should be applied as soon as possible, because once the event is created wrong, it's that way forever.