You can look at process SID (security identifier), which should give you info about the user.
Won't that always show the SID of the user that created the process though? (threads can temporarily impersonate another user)
Another one might be when a network user changes a file on a share. Let's say this is running on the file server - presumably we get the local process name, and presumably it would be running as Network Service or similar, so we wouldn't get the user that actually made the change?