jboss-web.xml allows for disabling security audits for the application. The configuration looks like:

<jboss-web>
    <disable-audit>true</disable-audit>
</jboss-web>

However, the current WildFly upstream/master doesn't honour this setting and the security audit events are logged irrespective of what value is set to this element.