NT AUTHORITY means the local machine's built-in service accounts. The best known of these is the SYSTEM account - which runs everything from the login screen to most of the high-privilege background services - but there are others by default such as LocalService and NetworkService (more restricted than SYSTEM and used to run background services that don't require enough access to completely take over the OS). NT Service Login (also just known as SERVICES) is for user-installed service accounts. Broadly speaking, a service account is any account which can be used as the principal for a non-interactive service process (most of them also disallow local or remote user login, to reduce attack surface). Whenever a Windows Service starts (this includes all the things listed in
services.msc but also stuff like drivers), the Service Control Manager (or SCM, running in
services.exe, which itself runs as SYSTEM) creates tries to create a security Token for the service's defined user - which may be one of the built-ins or any other service-login-allowing user - via a system call that gets logged as a service login attempt (this is what you're seeing). If the call succeeds, the SCM launches the service's process using that Token.
To answer your question:
It's only safe to whitelist these accounts to the degree that you are sure nobody can install a malicious service that uses them. Installing a service is simple - it's a few API calls to the service control manager, or just a few registry edits followed by a reboot, and many software installers will do it - but both options require either Administrator-level privileges or some way to bypass ACLs (such as offline access to an unencrypted OS volume). Because installing a service requires high privileges, any user with such privileges can configure any service to run under any account.