I have enabled remote syslog and I do not see logs for example when user does "sudo".
For me it looks like remote syslog does not get all the logs, because rsyslog cfg file include is defined after the filter for CRON, sudo and su is applied.
In /etc/rsyslog.conf this part:
$outchannel auth_log,/var/log/auth.log if $programname == 'CRON' or $programname == 'sudo' or $programname == 'su' then :omfile:$auth_log if $programname == 'CRON' or $programname == 'sudo' or $programname == 'su' then stop
is before:
$IncludeConfig /etc/rsyslog.d/*.conf
and remote syslog server is defined in
/etc/rsyslog.d/00-vyos.conf