Why are ASR Rules applied in audit mode blocking processes

I have two ASR policies deployed to different groups, one where most rules are block mode and one where all rules are audit mode.

The Block mode policy is deployed to one device group.

Audit mode is deployed to all devices.

According to my ASR reports and device timelines, ASR rules are blocking processes from devices enrolled on the audit mode only policy.

The rules applying the block are:

• Block all Office applications from creating child processes
• Block Win32 API calls from Office macro

I've reviewed the audit policy and verified all the rules are set to audit mode. I've reviewed the policy deployment, and these assets are definitely enrolled on the audit ASR policy. I've reviewed the ASR reports and the device timelines. Both are showing that the ASR rules blocked these processes.

Why is defender for endpoint blocking these processes when the rules are set to audit and how do I get it to stop? 

Thanks