Uses time impersonation occurred, rather than
time the audit event was created in a background
job as the timestamp on the audit event.

Changelog: fixed
EE: true