It only took me 15 minutes to verify my theory that this is likely a view code error. I changed wsal-items-per-page from 5000 to 10 and verified that there were only 10 entries in the database as expected.
When I look at the 10 entries using different views I see a correct result when sorting by Code and by Date and duplicated entries with incorrect dates when I sort by Username or by SourceIP.
I notice in AuditLogListView.php there are a number of “ToDo” comments related to…Sortable View based on Username or SourceIP…hmmm a bit suspicious!
Can you guys take another look at AuditLogListView.php code. When you tried to reproduce this issue did you try it on multi-site on php7? There have been some changes in php7 related to the logic involved in the display of these sortable lists.