Hello, salute to experts!

We have some users who are currently on vacation, how come we still see some WinEventLog:Security EventCode=4624 log entries?

How can we identify users who are actively working in our office environmt?

How can we identify users who are actively working, who login remotely via VPN, who are actually working in office? from WinEventLog, or any other logs?

Thanks