Win Event Log showing all events as debug severity from some servers

Zenoss Core 5.1.7

Windows Zenpack 2.6.4

PythonCollector 1.8.1

I'm using winRM to pull Event Log info. All of my 2008 R2 boxes appear to work fine, and a few of my 2012 R2 boxes work but most of the 2012 R2 boxes will pull all events as debug severity. In addition on those servers it ignores my Event Query filter on my Datasource: { $$_.Level -le [System.Diagnostics.Eventing.Reader.StandardEventLevel]::Warning } and pulls all events. On the servers that the severity is intact the filter works properly.

I have attempted to test the Powershell query and it seems to work fine when run manually. I examined the server features, powershell versions, .net framework etc and everything seems to be in order.

Any ideas are appreciated!