You have configured an email notification (or other notification) for "Single Virus Events". However, it appears to take at least 20 minutes for this notification to be generated by the SEPM. The on-screen notification appears immediately on the SEP client.
This is to be expected. Event Notifications and Event Log Forwarding are separate steps. Virus events will be written from the client to the server based on the log aggregation setting on the client, but alerts/notifications will be generated based on the Notification Damper setting.
Event log forwarding is dependent upon the Log Aggregation frequency policy (part of the Antivirus and Antispyware policy) that is active on the client.
To set the Log Event Aggregation value