That Windows Security Logging Esoterica blog is one of my favorites, I am sad that it's no longer maintained.
You might also find some of Randy Franklin Smith's past presentations on things like Logon Failures interesting, in some of them he goes through some of the detail on where actual events occur and why they might not occur where you think they do.