Hello there,
You can use process monitor to find the process. This event is logged if Windows was unable to write events to the Security event log. The code for the reason of occurrence. Whether the system should halt when not able to write to security log.
Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon https://learn.microsoft.com/en-us/sysinternals/downloads/procmon
----------------------------------------------------------------------------------------------------------------------------------
--If the reply is helpful, please Upvote and Accept it as an answer--