Single alert produces Session denied multiple DC servers LDAP 389 and why ?

[magendran.gopinathan]

Hi,
Login Successful After Scan Attempt 
I have a question regarding when user connecting VPN --which means session denied for multiple DC servers--Via global protect VPN. 
SourceZone:GP-c
Type -TRAFFIC
Denied Port-389 which means LDAP.

Session End Reason-policy-deny
@everyone

once the user connected VPN with successful authentication Why scanning happening?

[arusharma]

What type of scan is happening? 

[magendran.gopinathan]

We observed multiple DC servers  from one SRC machine to Multiple DST DC servers IP are captured and for the port 137 & 389 all the sessions are denied when user facing VPN issues.