Microsoft.Diagnostics.Tracing: Incomplete data in payload for some OS providers

For some type(s) of built-in Windows events, I'm not getting the complete payload, namely AppId/AppVersion, and also I can't figure out how to get PartA data. To demonstrate, here’s a short LINQPad code sample: http://share.linqpad.net/5hsr9t.linq

using var session = new TraceEventSession("EtwMonitor", TraceEventSessionOptions.Create);
session.EnableProvider(new Guid("487d6e37-1b9d-46d3-a8fd-54ce8bdf8a53"));

session.Source.Dynamic.All += delegate (TraceEvent e)
{
    if (e.EventName == "AppInteractivitySummary")
    {
        LINQPad.Extensions.Dump(e, e.EventName, collapseTo: 0);
        e.ToString().Dump();
    }
};
session.Source.Process();

However, it doesn’t give me the PartA properties, or even the AppId in the data section. Here’s what I get from the library:

<Event MSec=  "4249.0443"
    PID="45780"
    PName=        ""
    TID="48412"
    EventName="AppInteractivitySummary"
    ProviderName="Win32kTraceLogging"
    UTCReplace_AppId="0000b2d4-0002-001e-2a75-1bec3a50d801"
    UTCReplace_AppVersion="True"
    UTCReplace_CommandLineHash="True"
    PartATransform_AppSessionGuidToUserSid="0000b2d4-0002-001e-2a75-1bec3a50d801"
    AppSessionId="0000b2d4-0002-001e-2a75-1bec3a50d801"
    AggregationStartTime="4/14/2022 12:56:06 PM"
    ...
/>

And here’s what I get from the TelemetryRealTimeTool:

"data": {
        "AppId": "U:Microsoft.WindowsCalculator_11.2203.1.0_x64__8wekyb3d8bbwe!App",
        "AppVersion": "11.2203.1.0_x64_!2022/03/29:18:19:11!0!calculatorapp.exe",
        "CommandLineHash": 791235508,
        "AppSessionId": "00010D88-0002-001E-8F8D-E8B72F50D801",
        "AggregationStartTime": "2022-04-14T18:33:13.8264585Z",
    …

Any idea why AppId/AppVersion are being stripped replaced? Is it some kind of security feature at work? And is there any way to get PartA event data using the library? Thanks!

Start with the LINQPad reproduction using TraceEventSession, EnableProvider, and Source.Dynamic.All for the AppInteractivitySummary event. Compare the library output with the TelemetryRealTimeTool data, focusing on AppId, AppVersion, and PartA. Done means determining why those fields are replaced or missing and documenting or enabling access to the complete payload.