Update - we just quickly confirmed on our end that the LEM appliance can receive TCP/syslog on 514. 
If those log lines are from LEM's logs, it is indicating that syslog-ng on our end is receiving the 514 connection, then it's getting closed - perhaps we're not getting any data over it and there's nothing to log? You might try a packet capture - are you seeing data come from TW to LEM on TCP/514 after the established connection?