Reducing the level of this item. This behavior happens too often in a normal enviornment, with day to day activity and no definitive threat. I believe a different rule, detecting a larger volume of this behavior would warrant a high level rating.

rules/windows/builtin/security/win_susp_failed_logon_reasons.yml

@@ -5,7 +5,7 @@ description: This method uses uncommon error codes on failed logons to determine
 status: experimental
 author: Florian Roth
 date: 2017/02/19
-modified: 2021/10/29
+modified: 2022/06/29
 references:
     - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
     - https://twitter.com/SBousseaden/status/1101431884540710913
@@ -35,4 +35,4 @@ detection:
     condition: selection and not filter
 falsepositives:
     - User using a disabled account
-level: high
+level: medium