Update - this is an apparmor profile issue. I ran aa-logprof and added reading access for /run/log/journal.