Thanks Erik,
Our security team does periodically probe our SQL servers, but the error is different and it's usually from another server. It looks like this one came from the...

Thanks Sue,
Never used extended events, but another DBA here has. We'll give that a shot.
Thanks!
Lynn