Why WinEventLog:Security EventCode=4624 log entries from users currently on vacation

Hello, salute to experts!

We have some users who are currently on vacation, how come we still see some WinEventLog:Security EventCode=4624 log entries?

How can we identify users who are actively working in our office environmt?

How can we identify users who are actively working, who login remotely via VPN, who are actually working in office? from WinEventLog, or any other logs?

Thanks

btw, the purpose is to find who goes to office, and who works remotely, as part of covid-19 tracking