I often see errors logged in my SQL errorlog regarding login failure for sa

I have enabled a trace for server logins and the trace shows that these
login attempts are from a remote server (Application name is Microsoft SQL
Server, PID is that of the remote SQL server process).

How do I find out what is triggering these login attempts?

We are using transactional replication using "push" replication. The invalid
login attempts are from the replicate server to primary server. Is this
anything to do with replicaiton. Note: I do not use the sa id for replication.