The windowsevent-parser() only does a translation of XML data structures to macros in a slavish way, so if there are child nodes of the EventID XML tag, then they will be reflected in the macros of syslog-ng.
This problem could be overcome by using this rewrite rule:
rewrite r_fix_eventid {
set("${.win.Event.System.EventID.EventID}", value("EVENT_ID") condition("${.win.Event.System.EventID.EventID}" ne "");
set("${.win.Event.System.EventID}", value("EVENT_ID") condition("${.win.Event.System.EventID.EventID}" eq ""); };