I have a 3900x and the same issue, the only thing that worked was to emulate to Skylake so AES NI is present:
<cpu mode='custom' match='exact' check='full'>
<model fallback='forbid'>Skylake-Client</model>
<topology sockets='1' dies='1' cores='2' threads='1'/>
<feature policy='require' name='hypervisor'/>
<feature policy='disable' name='pcid'/>
<feature policy='disable' name='hle'/>
<feature policy='disable' name='erms'/>
<feature policy='disable' name='invpcid'/>
<feature policy='disable' name='rtm'/>
<feature policy='disable' name='mpx'/>
<feature policy='disable' name='spec-ctrl'/>
</cpu>