To help identify where this is being triggered, follow below guide.
Go to Entra https://entra.microsoft.com/#view/Microsoft_AAD_IAM/EntraLanding.ReactView
On the left panel, scroll down to monitoring and health, click the drop down menu and select ‘sign-in logs’
Click add filter and put in affected users principal name and hit apply.
Then add another filter, select status and value as failure. Again hit apply.
Its worth noting automatic filter will have date range 24 hours, as a suggestion for investigating repeat account lockouts, please click into date range to expand to 7 days to identify common triggers patterns. Again hit apply.
Data will display as below.