We have configured the project settings to include specific fields as sensitive, but we are still observing that sensitive data points is still being exposed in the event.

If adding the 'email' to the Additional Sensitive Fields doesn't help, the solution here would be to set up an Advanced Data Scrubbing rule in a following way, in your org's settings:
​
​

By providing an eventID, you'll be offered with all the available fields for scrubbing data.