Suggest you set the log to go to a directory either user A OR user B can write to (just to get around that issue of permissions). Also, run a ssh as user A from box A to box B that doesn't run sudo to user B, just to make sure the password it's asking for isn't for the actual ssh versus the change of ID.

Try giving the full path to your su command:
change "sudo su - userB /opt/rah/rah/rah/command.sh"
to "sudo /usr/bin/su - userB /opt/rah/rah/rah/command.sh"