Event ID 50 TermDD x.224

Hi Experts, I have an SBS2011 server that gets hundreds of Event 50 TermDD x.224 events logged. Specifically the text is shown below. I've read this can be related to RDP and it refers to it in the event, but no one accesses this server via RDP, this example below was at 3:48AM but it happens all throughout the day and night. Right now the only user who is enabled to use RDP is administrator.

Has anyone experienced this and any suggestions on where to look to fix this?


Log Name:      System
Source:        TermDD
Date:          8/30/2015 3:48:30 AM
Event ID:      50
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      servername.domainname.local
Description:
The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="TermDD" />
    <EventID Qualifiers="49162">50</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-08-30T08:48:30.190337900Z" />
    <EventRecordID>5608964</EventRecordID>
    <Channel>System</Channel>
    <Computer>servername.domainname.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\Device\Termdd</Data>
    <Data>X.224</Data>
    <Binary>00AB0800020030000000000032000AC00000000032000AC0000000000000000000000000000000002200000000000000</Binary>
  </EventData>
</Event>