How can I find out what is using NTLM in my environment?

I have seen Event Logs in Windows Event Viewer with EventID 6038 from Source LsaSrv.

My systems are: SQL server 2019 and Windows 10 20H2 machines.

I am attempting to audit what is using NTLM Authentication but do not know how to do this within Windows 10 or Windows Server.

Know someone who can answer? Share a link to this question via email, Twitter, or Facebook.