We see the same behaviour in the Event Viewer but to be honest I don't use it that much as it is a stateless machine so no much usefull info inthere anyway. Normally you need the eventviewer to check what went wrong and normally the machine has been cleaned by the time you want to look up that info in eventviewer.

The reason why it is that big is due to the fact that it merges all registry keys of the machine in those hyves. If you were to browse to the location c:\snapvolumestemp where it creates the mount point you would see that it does not only contain those folders that are created or are present within the appstack, it shows all available folders on your system. There are options to look into the folders or registry hyves that are only available within that appstack but you would need to bypass the Appvolumes Filter driver for that.