Yes, I've read this post https://developer.apple.com/forums/thread/770959?answerId=818506022#818506022 and I've looked at the pid in the responsible_audit_token structure for an XPC Service in question. Namely, through the eslogger tool I looked at the "exec" event when the /usr/libexec/xpcproxy executed a service, and I saw that pids in the audit_token and responsible_audit_token of the service were equivalent and denoted the final pid of the launched service (NOT the pid of a domain process who asked for that service initially). So, unfortunately this didn't work for me.