You may need to look in the raw log files for authentication failures. These records will have a status code of 407 and are typically not imported into WR which is probably why WR isn't helping you.
We had a similar issue with a couple of versions of Chrome. Under certain conditions, Chrome would bombard the MWG with requests that weren't authenticated. It was so bad that the logs became very large and threatened to fill up the disk. Thank goodness for log compression! Not saying that Chrome is the culprit in your case...you'll have to do some investigation and find who/what may be issuing requests that aren't authenticated.
Hope that helps,