the audit record information only have the instance information, not have the interface node information. If the instance service id is the same, the audit information can't tell which interface node it is. The audit trail record should contain the interface node information or the Full modules information.
For example, screenshot "audit_pimodules" only tells OPCInt_ReadOnly2, no interface mode information.