After the upgrade from 6.X to 7.X policy related event logs are sent using different level. On 6.X, these events had "DEBUG" level, but after the upgrade to 7.X they are sent with "WARNING" level:
This is expected behavior. If your syslog server is relying on level of the message to perform events categorization, you may use unique ID (380002) to differentiate policy related events.