During an enterprise incident investigation, analysts notice that correlation rules across the SIEM are failing to link related events from the firewall, the domain controllers, and a cloud IdP. Manual review confirms the events are genuinely related, but the SIEM's timeline shows them scattered across hours that do not match the true sequence. Each source is forwarding logs successfully with no drops. What is the MOST likely root cause the SIEM engineering team should investigate first?