After a little research, I am pretty sure these are normal and they do not appear to get onto my server. The logs show nothing further than the "cs-uri" column, where-as genuine entries do.
See attached for the latest ones, I have replaced my IP with "My IP Address" for security. This investigation was prompted by a recent worrying event log pasted below but this doesn't tie up with the logs -
Event Type: Error
Event Source: SAM
Event Category: None
Event ID: 12294
The SAM database was unable to lockout the account of Administrator due to a resource error, such as a hard disk write failure (the specific error code is in the error data) . Accounts are locked after a certain number of bad passwords are provided so please consider resetting the password of the account mentioned above.