I have adaudit + to monitor my DCs

I start to get alert about unusual login attempt (out of business hours) from computers and users.

those users didn't logoff and leave disconnect session.

on the domain I can see event 4768.

I cant understend why it start give me those false alerts...

it start 2 days ago and I didn't change any on the adaudit settings.

Any ideas?