Hello Eric Jiang,
Thank you for posting in Q&A forum.
Based on the description, it seems your win10 and win11 are in workgroup.
What account did you use to logon? Are they local user accounts?
This event is logged for any logon failure. It generates on the computer where logon attempt was made, for example, if logon attempt was made on user's workstation, then event will be logged on this workstation.
Sometime 4625 could record src-ip & src-port,sometime could not, also sometime have null 4625 log.
Check if these event ID 4625 have the same account you are using now.
I hope the information above is helpful. If you have any questions or concerns, please feel free to let us know. Best Regards, Daisy Zhou
If the Answer is helpful, please click "Accept Answer" and upvote it.