Other than scheduled task, it could be some services or applications that are running on the maching under this user account on the workstation DEF. Collecting a network trace / Process monitor logs can help you find what process what traffic causing
this when the event ID occurs.
Microsoft is conducting an online survey to understand your opinion of the Technet Web site. If you choose to participate, the online survey will be presented to you when you leave the Technet Web site.