how to filter for Kerberos traffic

During Security Log review on a Windows 2003 server I came across a repeated Event ID 531. Event gets logged 11 times every hour and does not have much details other than it’s a network log on/off (Ex. 11 times @ 5:11:15AM, 11 times @ 6:11:15AM, 11 times @ 7:11:15AM)

Logon Failure:

Reason:     Account currently disabled
User Name:  
Domain:     
Logon Type: 3
Logon Process:  Authz   
Authentication Package: Kerberos
Workstation Name:   MAILSRV1
Caller User Name:   MAILSRV1$
Caller Domain:  CORP
Caller Logon ID:    (0x0,0x3E7)
Caller Process ID:  7152
Transited Services: -
Source Network Address: -
Source Port:    -

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Is there a way to create a filter in wireshark what would help identify the computer initiating the logon attempt?

Thanks