Hi Anthony,
Thanks for your reply.
I found that it was virus. One of the users laptop was constantly probing all sql servers with sa login. I removed it from LAN and got stopped. I also found that the trojan virus infected his laptop. Informed Network and Infra team to take necessary action.
Regards
Govind