whizkid2300 said it, I will refine it ( again! )

(Don't give us your specific IP or network , the logs can be adjusted before you post, BUT )

What exactly are you referring to? How about a sample of the log that you are suspicious of ( with the name of the log ) ?

How is your network configured? This may seem like a dumb question, but is your DHCP server that you are referring to inside the LAN, behind the firewall that whizkid2300 asked about?

What are the RAS (Remote Access Services ) entries that you are worried about? Are they rouge machines connecting from within, or are they established machines connected to unfamiliar addresses outside, or is the server itself making connections or is it assigning these addresses?

As Johnny 5 said, “ need more input”