Hi Roelf, welcome to the forums.
In general you’re going to get help much faster if instead of interpretations or abbreviated descriptions, you just include the actual code of your rules and the full log entries. Put them all in different code fences sections (how to use code fences) so that they can be easily read and then it should be pretty easy for us to find a solution for you.