The command monitoring spec implies we should generate events for auth commands, and redact the sensitive information:

Some commands and replies will contain sensitive data and in order to not risk the leaking of this data to external sources or logs their commands AND replies MUST be redacted from the events. The value MUST be replaced with an empty BSON document. The list is as follows:

I interpret this to mean the saslStart command should still generate corresponding APM events, but strip the reply documents of any potentially sensitive information.