Help with figuring out odd RDP event

Hey y'all, I am struggling to come to a conclusion about an RDP event I have noted in a job.

Log was identified on a Microsoft RDS server (lets call it WIN-RDS), it was an Event ID 21.

WIN-RDS has **internal** IP of 10.1.1.10 and an **external** IP of 192.178.1.1

The associated Windos Event ID on WIN-RDS is 21 and states the source network address is 192.178.1.1.... remeber that WIN-RDS has captured this event log and 192.178.1.1 is its own …

computerforensics event rdp