Thats a red herring. When authentication is enabled, you will see the "dark figure" whenever authentication occurs. You likely need to wait a minute for the rest of the traces to appear (as they are probably sitting in the buffer).
It's important to understand that authentication occurs over multiple steps.
---- Rule trace #1 -----
1) You make a request (no credentials included)
2) MWG responds asking for credentials (Basic, NTLM, Kerberos)
---- Rule trace #2 -----
3) You make a new request (same TCP connection) including credentials... lets say Kerberos
4) MWG authorizes the request, but web server returns a 404
As far as why you get a 404, if you have an SR open, we can take a look at that.