The events are "plug/unplug" events.
When a user plugs in a USB device, an event is generated.
Also when a device is unplugged.
Which is fine because that's how it should behave but what's unusual is why these events are created so many times with unique eventIDs when the user is not plugging or unplugging that many times in reality.
Just wondering if you are seeing the message in a pair on every plug event?
ie when I plug my newish USB stick.
Device Class GUID: EEC5AD98-8080-425F-922A-DABF3DE3F69A
Device Class Name: Portable Devices
Device Name: LA-PUBLIC
Device Compatible ID: wpdbusenum\fs
Device Instance ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_LACIE&PROD_I AMAKEY&REV_1.00#000000000xxxxxxx&0#
Device Class GUID: 36FC9E60-C465-11CF-8056-444553540000
Device Class Name: Universal Serial Bus controllers
Device Name: USB Mass Storage Device
Device Compatible ID: USB\CLASS_08&SUBCLASS_06&PROT_50
Device Instance ID: USB\VID_059F&PID_1027\000000000xxxxxxx
Bus Type: USB
Vendor ID: 059F
Product ID: 1027
USB Serial Number: 00000000078C2F6F
USB Class: 08h - Mass Storage
Get a machine for testing, and drill down your reporting on just that machine.
Plug and unplug (send alerts between each, or retreive them via EPO agent wakeup) things like USB keyboard, USB mouse, etc.
We had something similar just with a usb mouse ,because the driver had a 'low power' mode which turned off the mouse (not sure why anyone thought this would EVER be a good idea) and it caused it to generate a 'new' alert each time Windows 'saw' the device again.
Either way, narrowing down to a single machine and verifying what happens, when, and make sure you can control your variables would be a good first step - to take a step backwards and look at a smaller scope
I ran MER on some exceptionally high event gerating systems and found out lots of events were coming from source 'SDDisk2k' which is Winmagic Secure Doc.
Working on it to see why it's causing this issue.
However, thanks Keithdrone for your potential input, I already thought of that situation before but wasn't confirmed.