false alerts about unusual login attempt

false alerts about unusual login attempt

I have adaudit + to monitor my DCs
I start to get alert about unusual login attempt (out of business hours) from computers and users.
those users didn't logoff and leave disconnect session.
on the domain I can see event 4768.
I cant understend why it start give me those false alerts...
it start 2 days ago and I didn't change any on the adaudit settings.
Any ideas?