Remove reference to Client Server Runtime Process and add more clarity that the pid value represents the process that creates the event (which in some cases is made by processes other than the one doing the thing that is getting logged). (Maybe link to microsoft documentation too?)