Audit Dashboard report shows a larger number of users for Audit services than the user count for those same services in the Audit -> Services section in CloudSOC
Events from a data source that does not have 'Ignore Indirect Traffic' option set
When 'Ignore Indirect Traffic' is not checked, there will be data stored to Audit for users that were redirected to the service and blocked.
The solution is to filter out users who were blocked from the service. A filter like Blocked Bytes <= 0 will remove users who were blocked and show users that were not blocked when accessing the service.