The event ID 20999 is being forwarded to the Syslog server from Server Settings > Event Filtering page > Syslog Server that has been configured on the Registered Server page.

To filter out events from being sent to the Syslog server, on the Event Filtering page, select the option Store selected in McAfee ePO instead of Store selected in both.

NOTE: Only the Solidcore events mentioned in the Product Guide are registered here. These events can be prevented from being sent to the Syslog server. The Event ID 20999 isn't registered as of now and hence can't be filtered out. It will be included in future releases.