When you connect to PS server audit log always shows the database which was specified upon connecting and if you switch default database it will always show the first one in the log. Consequently if you didn't specify any upon connecting DB field will always be empty.
Here's the test case:
In my log files CASE1 is when I connected without specifying default database and CASE2 is where I specified "test" database as default upon connecting.
In CASE1 you can see following:
so here DB field is empty, but table "t2" is actually in "test2" database.
In CASE2 we get following:
so here DB="test", but this is wrong because the actual database of table "t2" is "test2" but it is showing the "test" here because I used that one when first connecting to the server.
For this particular issue you don't even need "set global audit_log_include_databases='test';" but I left it because my logs were created with it so I don't have to record again.