Profiler does not reveal anything. Both test and prod results look the same.
No third party software. Both are pretty plain jane MS installations. The only difference is that test is NT SP6a / SQL SP2 and prod is NT SP4 / SQL SP1. That should not be a factor.
The events are being captured under Application Log events with:
Source = MSSQLServerOLAPServices
Category = Server
User = N/A
with the description = User SICPA\jharper opened connection 4 from RENW0031
Local logins are being captured under Security Log events for both servers.