I am using NetApp 8.3 on a simulator and experiencing the same issue.
I has set an event with 2 filters and it does not work for write-first events (ie I am getting tons of SMB_WR events)
fpolicy policy event create -vserver cluster1 -event-name event1 -file-operations create, create_dir, delete, delete_dir, read, write, rename, rename_dir, setattr -protocol cifs -filters first-read, first-write
However, if I set with only one filter , it works (I only get 1 SMB_WR ou SMB_CREATE event)
fpolicy policy event modify -vserver cluster1 -event-name bw_event -file-operations create, create_dir, delete, delete_dir, read, write, rename, rename_dir, setattr -protocol cifs -filters first-write