Changing logging driver form journald to json has fixed it.
I edited /etc/sysconfig/docker, and set
OPTIONS='--selinux-enabled --log-driver=json-file --signature-verification=false'
Then restarted docker on the nodes I needed:
systemctl daemon-reload && systemctl restart docker
Million dollar question - are you running your fluentD as a DaemonSet? If not, there's a chance that fluentd simply isn't running on the node where some containers live.
Otherwise, my best guess is, it's missing permissions to read from all namespaces, especially since you mentioned you haven't attached a ServiceAccount to it. If you used a public FluentD ...