I have to rule out any WMI issues or this would be apparent in other backend support systems. I'm guessing that the time it takes to pull a large number of users/groups, and/or a large number of event logs exceeds the default 30 min threshold.
Either way, scans are not completing before the 30 min threshold is reached. Is there any way to adjust this?