I'm pretty sure it's connecting as sysdba, which is why all the .aud files are being generataed I would think, unless CRS is doing it?

I thought turning audit_sys_operations was turning off auditing?