Unusual SSH Parent/Child Execution

sequence with maxspan=3s
  [process where event.type == "start" and event.action == "exec" and process.parent.name in ("sshd", "ssh") and
   not process.executable like ("/run/*/newroot/*", "/srv/snp/docker/*", "/tmp/newroot/*")
  ] by process.entity_id
  [process where event.type == "start" and event.action == "exec" and process.executable like (
    "./*", "/boot/*", "/dev/shm/*", "/etc/cron.*/*", "/etc/init.d/*", "/etc/update-motd.d/*", "/run/*", "/srv/*",
    "/tmp/*", "/var/tmp/*", "/var/log/*"
    ) and process.args_count == 1 and not (
      process.executable like~ (
        "/tmp/VeeamApp*", "/run/containerd/io.containerd.runtime.v2.task/k8s.io/*", "/tmp/.mount_nvim.*",
        "./merged/var/lib/containers/*", "/run/systemd/mount-rootfs/*", "./merged/*/containers/*",
        "/run/k3s/containerd/io.containerd.runtime.v2.task/*", "/tmp/.mount_*", "/tmp/usr/bin/groups",
        "./merged/usr/bin/clear"
      ) or
      process.parent.executable like (
        "./merged/bin/bash", "/tmp/nsjail*", "/run/user/1000/nsjail/*", "/usr/bin/run-parts", "/usr/bin/env"
      ) or
      process.parent.command_line in (
        "bash -c /bin/bash; uname -a &> /dev/null",
        "sh -c /usr/local/bin/sshd-with-logs"
      ) or
      process.parent.name == "jem" or
      process.name == "sestatus" or
      (
        process.parent.command_line == "sudo true" and
        process.command_line == "true"
      ) or
      (
        process.parent.executable == "/usr/bin/ctest" and
        process.parent.command_line like "ctest --test-dir /tmp/* --output-on-failure*"
      )
    )
  ] by process.parent.entity_id