The Common event set is designed to provide a full user audit trail while reducing volume versus "All events." It includes both sign-in (4624) and sign-out/logoff (4634) events. The Minimal set omits sign-out (and other audit events), so it wouldn't meet the requirement; Custom adds admin overhead, and All events increases volume unnecessarily.