A Logon Type 3 event is generated most commonly when a user logs on to a remote computer on a network for such purposes as to access a shared file or folder which is available on that computer. It can also be triggered by IIS logons if IIS is running on this computer. Have you noted any event ID #528 (successful logon) with a logon type 2 in your security logs? Logon type 2 indicates an interactive logon which occurs when a user logs on to a computer from the console.
Hope that helps!