Some Information Windows event log still be collected by Zenoss

We only want to collect windows events of severity warning, error, critical.

Then we set zWinEventlogMinSeverity=2 and no query in zWinEventlogClause.

But I still get some information log,like eventClassKey of "Microsoft-Windows-Security-SPP_902","Microsoft-Windows-Security-SPP_903","Microsoft-Windows-Security-Licensing-SLC_902"

and some information event in eventGroup "Operations Manager", like "OpsMgr Connector_21025" , "Health Service Modules_26005" , "HealthService_7028" , "HealthService_7025" ...

These events were auto mapped to "/Archive" event class, but according to our setting, the information windows event log of severity 1 (defined in Zenoss event page) should not be collected by Zenoss.

Any idea