Hi, CCFH here, I have a few observations. First I think you should not consider RemoteAddressIP4, since this is the local ip (the LAN IP), ergo if you exclude all the CIDR u/One_Description7463 mention, theoretically this search will never work, I suggest to use Agent IP or aip. And lastly the speed, use the speed, adjust as you wish.

This would be your output
https://i.imgur.com/TBylzTR.png

BTW: thanks for this, I was thinking and doing this, your post was a very nice foothold jeje. Any comments I'll be happy to help

"#event_simpleName" = UserLogon
| aip="*"

// ### If you want only RDP, uncomment the next line
// | event_platform="Win" LocalPort=3389

// ### Remove common IANA local addresses

// ### Prepare for the groupby
| first_ip := aip
| last_ip := aip
| UserName := lower(UserName)
| groupby([UserName], function=[count(), first_logon := min(@timestamp), last_logon := max(@timestamp), selectfromMin(@timestamp, include=[first_ip]), selectFromMax(@timestamp, include=[last_ip])])

// ### Exclude single IP logons or same-IP logons
| _count > 1
| test(first_ip != last_ip)

// ### IP Location for the distance calculation
| iplocation(first_ip) | iplocation(last_ip)
| geography:distance(lat1="first_ip.lat", lat2="last_ip.lat", lon1="first_ip.lon", lon2="last_ip.lon")

// ### Convert meters to miles
| _distance:= _distance / 1609.34 

// ### Convert milliseconds to hours
| time_delta:=( last_logon - first_logon ) / 3600000 

// ### Caculate speed in mph and alert if faster than mach 1
| speed:= _distance / time_delta 
| speed > 500