Account lock out issue

Thank you for the input folks. I did try to capture tcpdump end to end but it did not help me either since application data is encrypted and I cannot see client IP address in the X-Forwarded-For HTTP header. What options do I have in this case? Traffic pattern is already mentioned earlier, so there are multiple factors in play that is what I think. And tweaking existing ADFS set up may not be a good option, since it is working for all the other users. Any other input Please???

TIA...