When receiving lots of Failed Logon attempts, it is hard to identify the root cause of it, if we only look at the DCs event log.
It would be great to have source information, not just machine it is coming from but if we can provide more details to specifically show the source of it. Or look at the failure event log of the source machine it is coming from.