There was an issue with Envers in HHH-11107 Closed where a FK would be created if it was part of a @ManyToOne association inside a composite-key (@EmbeddedId) in your entity mappings. But this was fixed in 5.2.4.

With that said, I checked versions 5.2.11, 5.2.12 and 5.2.13 attempting to mimic your entity mapping from your screen shot and I did not see any foreign keys being generated in the audit tables that reference the main table to verify your claim.

I understand your company's desire to protect their intellectual property, but providing us our test suite populated with a couple of entities that mimic your setup in your production code replicating the issue should not violate that, especially if your entities are just generalized terms meant nothing more to illustrate the mapping issue.