They look to me like different events. The forwarder doesn't change any of the data that I have seen.
In your first paste that looks like an event log generated for an object that has been deleted and the reference to still exists, windows uses those strings (object references) in place of object names when they no longer exist.
Your second event paste explicitly says it is related to the builtin admin account but the first one doesn't have a target account name which would suggest to me that they are different events.
Could you double check that you have matched them correctly?