Event sourcing also works great. You don't need an audit log per se if you already track a history of all commands that introduced changes to your system.
Yep. But Event Sourcing comes with its own set of other problems. Also, I don't think this would apply to OP's post: with Event Sourcing you would not even have those DB tables.
Event sourcing and "the right to be forgotten" are not always easy to marry.