Clients receive events, when the ReceiveEvents permission is set on both the EventType and the SourceNode (https://reference.opcfoundation.org/Core/Part3/v105/docs/8.55).

Currently for the ServerObject (i=2253) the ReceiveEvents permission is set for ConfigureAdmin and SecurityAdmin Roles while EventTypes have no specific permissions set and use the application defined default permissions. This is problematic as the SeverObject is used as SourceNode for a lot of Events, some are of interest for many clients like SystemStatusChangeEventType (https://reference.opcfoundation.org/Core/Part5/v105/docs/6.4.30) or sub-types of BaseModelChangeEventType (https://reference.opcfoundation.org/Core/Part5/v105/docs/6.4.31) other Events may contain sensitive information and need to be restricted to certain Roles, especially AuditEvents.

So for a fine-grained control of Events that use the ServerObject as SourceNode, the ServerObject should have the ReceiveEvents permission set for Anonymous and/or AuthenticatedUsers and the specific EventTypes should have permissions set to further restrict access depending on the EventType.

For AuditEvents it may be favorable to introduce a own Role like "Auditors" and also set the AccessRestrictions to EncryptionRequired so the Events are only transported encrypted.