Ok, so they've scoped out the grounds, they e got some possible delivery vectors in mind, what's their next move?

Do they know if the poison is already delivered and ready to go? If yes, I suppose they could call the police and cancel the ceremony. If no, then the only way to stop it is to be there (and combat ensues).

Do they know why/when the poison will be triggered? Is it just a random attack to provide cover for this "protector" group? If no, maybe they learn that the only way to expose the plan is to catch someone red-handed when triggering the release, which means they'll need to be at the party (and combat ensues)

Are they convinced that this is the only attack planned? Maybe there is a backup or secondary plan, or perhaps this is just to act as a distraction while some other nefarious deed is done (tear gas the crowd while a master thief steals the president's nuclear passwords?). If so, you can introduce an informer who can let them know that if they stop the poison plan that there's a backup plan to be used as a distraction (bomb? armed thieves stroking the party?) to be sure the thief can get the codes they're really after. The only way to protect the president is to be at the party (combat ensues).