From community slack:

FYI, my team found a bug with https://github.com/elastic/beats/blob/v8.13.2/x-pack/winlogbeat/module/sysmon/ingest/sysmon.yml#L12 and https://github.com/elastic/integrations/blob/main/packages/windows/data_stream/sysmon_operational/elasticsearch/ingest_pipeline/default.yml#L12. The processor fails if winlog.event_data field doesn't exist. We added "if": "ctx.winlog?.even_data != null", to the processor.

The reporter thinks it was event ID 22 from Sysmon causing the problem.