Incorrect user account send to Microsoft Event Viewer on SMB differently on file delete and upload only and builtin function like create folder

I set up External Storage using SMB to a windows 2016 server with Log-in credentials, save in session.
When user trying to create text file or folder using the build in function of next cloud. In Microsoft Event Viewer I could get the correct account name, example <009>username<013>
However, when user upload or delete a file in SMB through Nextcloud. Microsoft Event Viewer get the login name as <009>Hostname$<013> instead of username.
This issue only happen in Nextcloud, where we have another server running owncloud with exactly same configuration has no such issue.