Windows Domain User is constantly locked out (MacOS environment)

A windows domain user is constantly being locked out.

we are a relatively small company and have only one domain controller. all users work with mac devices and iphones.

but after a password change one user is locked out all the time.

we have many different services and links that could be responsible for this (e.g.: office and exchange account, timemachine backup on synology nas connected to domain, etc...).

last time we had a similar problem but it was fixed because the source device could be located because the ip showed up in the event viewer.

but now the event viewer shows "\MOBILE" or "WORKSTATION" as the source device.

these are pretty generic names, especially "WORKSTATION" which is more typical for windows, but we only have macOS devices that could come into question.

the badpasswordcounts occur every few seconds and according to password policy a user is locked out after 5 incorrect entries.

Event IDs: 4740, 4741 and 4625 did not show any helpful information.

i also tried some lockout examiners from microsoft and netwrix but they couldnt help.

please help me. if you need more information, please let me know.

thank you for your help in advance.

Event Text:

A user account was locked out.
Subject:
	Security ID:		SYSTEM
	Account Name:		DC1$
	Account Domain:		INTRANET
	Logon ID:		0x3E7
Account That Was Locked Out:
	Security ID:		INTRANET\impacted_user
	Account Name:		impacted_user
Additional Information:
	Caller Computer Name:	WORKSTATION

A user account was locked out.
Subject:
	Security ID:		SYSTEM
	Account Name:		DC1$
	Account Domain:		INTRANET
	Logon ID:		0x3E7
Account That Was Locked Out:
	Security ID:		INTRANET\impacted_user
	Account Name:		impacted_user
Additional Information:
	Caller Computer Name:	\\MOBILE

(the \MOBILE is sometimes showing up as "blue" link, but of course event viewer cannot open it)