Beleive I have solved this myself.
the indicator of this issue that i should have noticed was that only two of my six DC's were logging a last report time. I understand now that this means only two of my six DC's were actually reporting logon/logoff data which is why there were sync issues.
i fixed this by upgrading the AD agent to version 2.3, dumping the old configuration and adding back the DC's. note, you can only have five DC's per agent including the localhost.then i addressed the reporting issue by creating a GPO that enabled auditing of logon/logoff events and applied that to the Domain controllers. finally i used a domain admin service account for the querying. after doing all of this all of my DC's are reporting now, ad my user events list has gotten much longer.