This event generates if an account logon attempt failed when the account was already locked out. It also generates for a logon attempt after which the account was locked out.
It generates on the computer where logon attempt was made, for example, if logon attempt was made on user’s workstation, then event will be logged on this workstation.
This event generates on domain controllers, member servers, and workstations.
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625