Failed Login Events from svchost.exe in event viewer

I recently checked my event viewer on windows server 2019 for monitoring rdp brute-forcing. I realised there are numerous failed login events with id 4625. All these originate from internally from svchost.exe and multiple times daily. Point to note is that target username changes everytime and none of the target user id belongs to my server. It looks like brute-force from windows internally??? I heard that similar problem is caused in case of scheduled task setup. What should I do.

EventData

SubjectUserSid S-1-5-18 
  SubjectUserName WIN-312KUNFDJAV$ 
  SubjectDomainName WORKGROUP 
  SubjectLogonId 0x3e7 
  TargetUserSid S-1-0-0 
  TargetUserName admin 
  TargetDomainName WIN-312KUNFDJAV 
  Status 0xc000006d 
  FailureReason %%2313 
  SubStatus 0xc0000064 
  LogonType 3 
  LogonProcessName IAS 
  AuthenticationPackageName MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 
  WorkstationName - 
  TransmittedServices - 
  LmPackageName - 
  KeyLength 0 
  ProcessId 0xc80 
  ProcessName C:\Windows\System32\svchost.exe 
  IpAddress - 
  IpPort - 

System

- Provider 
[ Name]  Microsoft-Windows-Security-Auditing 
[ Guid]  {54849625-5478-4994-a5ba-3e3b0328c30d} 
 EventID 4625 
 Version 0 
 Level 0 
 Task 12544 
 Opcode 0 
 Keywords 0x8010000000000000 
- TimeCreated 
[ SystemTime]  2020-03-14T05:24:46.630396800Z 
 EventRecordID 732765 
 - Correlation 
[ ActivityID]  {cf783dd8-f931-0000-133f-78cf31f9d501} 
  - Execution 
[ ProcessID]  628 
   [ ThreadID]  2752 
 Channel Security 
 Computer WIN-312KUNFDJAV 
 Security