These ones may help.
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
https://learn.microsoft.com/en-us/windows-server/remote/remote-access/ras/otp/troubleshoot/troubleshooting-authentication-issues
--please don't forget to Accept as answer if the reply is helpful--