Vsftpd: log failed login attempts
It looks like vsftpd first checks username in userlist_file and do PAM only if user is allowed (with above configuration). I would suggest to disable userlist_* options and implement deny list in PAM configuration.
# put this line into /etc/pam.d/vsftpd as first "auth" check
auth required pam_listfile.so item=user sense=allow file=/etc/vsftpd.allowed_users onerr=fail
Then you should see denied log attempts in auth.log.
More info - pam_listfile.so