Event 4624 on the DC when dialing in via RRAS

Hi,

Strange behavior when user connects to RRAS (IKEv2): logon event (ID 4624) appears randomly on the domain controller, sometimes it generates within the same minute, sometimes 20mins after the successful connection through RRAS. Does anyone else experience this?

RRAS and DC- 2012 R2

thanks.