It should, take a look at the audit action groups and what each on means and use the right ones you need to audit.

https://learn.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions?view=sql-server-ver16#database-level-audit-actions

Also remember why you're auditing,...

Set it as public.

Then in the audit it will show you the "Session Server Principal Name" and "Server Principal Name" of the person running the audit.

For the data, do you do deletes of the data? Are the tables all have a clustered index?  Are any of them heaps?

Database design can play a strong factor in...

OK, so lets tackle the log problem first.

As you say its a hobby and no criticality if something went wrong with the DB, then you could most likely get away...

Seems a little excessive, a 600GB log for a 17.5GB data space.

But without knowing the workload we cannot give you a definitive answer.  But something caused the log to grow...

That as always is a very much it depends answer.

What is your required recovery model for all databases which get created, or what should the majority be?

Chances are for prod you...

Set the nessesary exclusion on any scanning software, use handle/procmon to see if anyone / anything is using the file when SQL tries the delete.

Error 32 is “ERROR_SHARING_VIOLATION” something else...

The following doc details the steps needed to import a bacpac to the server.

https://learn.microsoft.com/en-us/azure/azure-sql/database/database-import?view=azuresql&tabs=azure-powershell

What Azure "flavour" of SQL have you provisioned as depending what you have deployed will depend on how you restore.

Do you have

Azure SQL DB

Azure SQL MI

Azure SQL VM

Azure SQL DB...

OK, well the first thing which is concerning is T-Log backups Mon-Fri in working hours.

What is the RTO / RPO here?

What happens to the DB outside of working hours?

You may...

What is the recovery model of the DB?

What is the log wait reuse description for the DB from sys.databases?

If recovery model is full, are their log backups happening?

They should be in the following registry key

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\Instance Names\RS

Try to start SQL in single user mode, IIRC that would disable the logon trigger and allow you to drop it, to start in normal mode and resume operation.

The query plan will help also, you can use https://www.brentozar.com/pastetheplan/ for that.

Additionally as Phil mentioned the DDL etc.

https://www.sqlservercentral.com/articles/how-to-post-performance-problems-1

Use MAP (https://www.microsoft.com/en-gb/download/details.aspx?id=7826), this is the way that MSFT would do it in an audit, so do as the gatekeeper does.