We have in documentation:
eventid - regular expression describing the event identifier(s)
and example:
eventlog[Security,,"Failure Audit",,529|680]

So in this case not only 529 and 680 eventlog IDs will be collected. 1529, 2529 and other which like to 529 from regular expression.

In this case would be better to use
eventlog[Security,,"Failure Audit",,^(529|680)$]