Looking at the Splunk add on for Cyber Ark, it appears the process is flawed in that
Thus if the XSLT iterates over more than one event, not only do the timestamps for the individual events get discarded, one possibly ends up with a single CEF like event with multiple key value pairs where the keys are repeated.
Basically it appears that multiple Cyber Ark events are concatenated together into one syslog record without any clear form of event separation and the timestamps for the 2nd and subsequent events are lost.