You can just run it without a filter. You then see lots of events, I would look at 'Process Name' column and you can right click ones that you know are fine and select Exclude 'Process Name' this will start shrinking the events that are logged and should help you find the culprit. If you don't know what a process is hover the mouse over and it will give you the full path. If you know what it is and expect it again exclude it