As per CSF v14.17
SMTPAUTH_LOG="/var/log/maillog" handles
.* postfix/smtpd[31452]: warning: unknown[?.?.?.?]: SASL LOGIN authentication failed: authentication failure
but it does not handle
.* postfix/smtps/smtpd[23507]: warning: unknown[?.?.?.?]: SASL LOGIN authentication failed: authentication failure
so for the latter lines you still need to use CUSTOM?_LOG and /etc/csf/regex.custom.pm