The call is coming from the same server as the SQL server and the application is "Microsoft ® Windows Script Host".

Example from the trace:

eventclass:Audit Login Failed

textdata:Login failed for user 'NT AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database 'PR_STAGE'. [CLIENT: 999.99.999.17]

hostname:SERVER17

ntusername:SYSTEM

ntdomainname:NT AUTHORITY

clientprocessid:7192

application:Microsoft ® Windows Script Host

loginname:NT AUTHORITY\SYSTEM

spid:69

starttime:2013-02-05 00:05:10.257

error:18456