Why are some of the new cipher suites not included with the Best Practices?

While TLS_RSA_WITH_AES_256_GCM_SHA384 and TLS_RSA_WITH_AES_128_GCM_SHA256 were included, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 and TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 were not. The latter were not included because Microsoft chose to use weak (1024 bit) Diffie-Hellman parameters in some versions of Windows. They did this in order to support older Java clients.

Microsoft has released an update (KB3174644) that enables stronger key lengths in Windows Server 2008-2012 R2. Windows Server 2016 and 2019 support 2048 bits by default. You can change the value by updating the DHE Minimum Key Length in Advanced settings.