What you're seeing is name canonicalization during the formation of the SPN. Kerberos requires clients to resolve names to the official record in an attempt to restrict hijacking/ticket theft and Windows enforces that.
Both Windows 7 and Windows 10 will do this by default, but it's possible to configure it to not do that through registry settings like ...
Dealing with Windows failed events can be a very hard task. Firstly, you have consider 2 types of failed events in Windows:
Kerberos logins (not in your scope): ID 4768, 4769, 4771
Windows logins: ID 4625, ID 4776
Considering now your event, the most meaning full events are the following:
Logon Type: 3 > network event
Workstation Name: Win10-Wrk > ...
There isn't really any other way to use it other than how it was designed because then you're not using SPNEGO, but some other protocol you've invented.
What I think you're asking is whether there are other mechanisms used out in the wild other than Kerberos and NTLM, and the answer to that is yes. A handful that I'm aware of are
NegoEx (an ...
Burp's Platform Authentication settings let you configure Burp to automatically carry out platform authentication to destination web servers. Different authentication types and credentials can be configured for individual hosts.