Use PowerShell to filter Event Logs and export to CSV
Get-EventLog -LogName Security -ErrorAction SilentlyContinue | Select TimeWritten, @{name='ReplacementStrings';Expression={ $_.ReplacementStrings -join ';'}} | where {$_.ReplacementStrings -notmatch '^S-1-5'} | Export-Csv output.csv