Hammered By Administrator Logins..........3 Times a second

I have a Windows 2003 R2 SP2 server that is logging on and off to it's self (I believe) 3 times a second. (9 events logged every second)
When I stop the remote registry service it stops.

I have stopped almost all of the services one at a time to try to figure out what is causing this, no luck finding the cause.

The server does RRAS/VPN and NAT
Has Trend Micro IWSS installed (which comes with SQL)
Also Trends client/server antivirus.

The name of the server is "NAT"

Any Ideas?......please

Below are the three events...repeated over and over.....



Event Type:      Success Audit
Event Source:      Security
Event Category:      Logon/Logoff
Event ID:      576
Date:            2/26/2009
Time:            1:52:06 PM
User:            DOMAIN\administrator
Computer:      NAT
Description:
Special privileges assigned to new logon:
       User Name:      Administrator
       Domain:            DOMAIN
       Logon ID:            (0x0,0x5D889C1)
       Privileges:      SeSecurityPrivilege
                  SeBackupPrivilege
                  SeRestorePrivilege
                  SeTakeOwnershipPrivilege
                  SeDebugPrivilege
                  SeSystemEnvironmentPrivilege
                  SeLoadDriverPrivilege
                  SeImpersonatePrivilege

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:      Success Audit
Event Source:      Security
Event Category:      Logon/Logoff
Event ID:      540
Date:            2/26/2009
Time:            1:52:06 PM
User:            DOMAIN\administrator
Computer:      NAT
Description:
Successful Network Logon:
       User Name:      Administrator
       Domain:            DOMAIN
       Logon ID:            (0x0,0x5D889C1)
       Logon Type:      3
       Logon Process:      Kerberos
       Authentication Package:      Kerberos
       Workstation Name:      
       Logon GUID:      {478cbe2d-3d3c-faa4-1c66-69f8a0fe4xxx}
       Caller User Name:      -
       Caller Domain:      -
       Caller Logon ID:      -
       Caller Process ID: -
       Transited Services: -
       Source Network Address:      -
       Source Port:      -


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:      Success Audit
Event Source:      Security
Event Category:      Logon/Logoff
Event ID:      538
Date:            2/26/2009
Time:            1:52:06 PM
User:            DOMAIN\administrator
Computer:      NAT
Description:
User Logoff:
       User Name:      Administrator
       Domain:            DOMAIN
       Logon ID:            (0x0,0x5D889C1)
       Logon Type:      3


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.