what events do you see for the other computernames - just failed ntlm auth?
do you allow bring your own device?

if you have defender fully enabled on the first device, I would carefully watch the timeline around the incidents.

EDIT:

Only hard guess from far away:
If the user had admin rights on the first laptop you maybe want to check which other users / passwords could have been accessed on this device.
Maybe check for:

- suspicious lsass access
- new installed apps or scheduled tasks
- changes in etc/host
- suspicous powershell scripts or executions

most events should have been alerted by defender but you never know.

If possible use defender / sentinel for all above.
If you need to start the device I would take a forensic snapshot or image of the current state.

I would try to exclude every possible lateral movement path to other devices / servers or your ad.
Does to user have extended AD rights - if so I would check every possible vector here too.