True, but most were out of my hands I think as many were that it could not find someinternetserver.com. Anyway, it was a .local domain and I wasn't forwarding traffic through the AD server - I configured all the NICs to use our ISP's DNS in primary and our local DNS server as the secondary and the server was set to forward requests, again, to the ISP's DNS. Gateway was set to the router. I'd be inclined that sites that could not be resolved by the primary were attempted to be requested by our DNS server, not resolved due to site not existing any more, then thrown up as an error in the event log.