I'm seeing no IP information in this security event.  Source Workstation is "windows7" or "freerdp"

Keep in mind...the error code means "user does not exist" so in this case the user list is about 1800 user names like "scanner" "testuser" "support" to name a few.  Has anyone seen this activity?