Well, at least now we know what's going on ;-)
There are two possible workarounds:
- install the latest packages from the security:apparmor repo - or -
- convert the log to the old format on the fly:
aa-logprof -f <(sed 's/class="[a-z]*" //' < /var/log/audit/audit.log)