Trying to find who is loggin in to the server. Look in Event Viewer for Security with the filter for 4624 events:

Note it is normal to see multiple logins, you are looking for specific logon types:

2 and 10

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624