@ctaylor3819 Try using the below query for the date and time:
eventtype=wineventlog_security (EventCode=4776 OR EventCode=4777 OR EventCode=680 OR EventCode=681)
| stats latest(_time) as Latest_Time by Logon_Account
| convert ctime(Latest_Time)
In order to filter the users you can you a lookup file containing the list of users you want to get or the list of genuine users and use a lookup command to get only those users.
Also, If this reply helps you, an upvote would be appreciated.