Good day,
Please execute the following query to check if the sa account you see is the real original sa account:
SELECT name
FROM sys.sql_logins
WHERE sid = 0x01;
The sa account always has 0x01
Ensure no other logins are named sa
SELECT sid, name
FROM sys.sql_logins
WHERE name = 'sa';
Next check in the audit log what this sa account is doing (maybe simply an attempt to connect by someone and it failed ?)