First, to clarify, the 5xx codes are from 2k3 whereas the 46xx codes are from 2k8. Ensure you're working with the right set of codes, or simply using both, when researching the event id's.
Next, I would personally go with 576 and 4672 since they signify specifically a logon event has occurred where the identity has privileged capabilities. The others are related to privileged operations that are not limited to login-time operations, but object accesses, etc...
Finally assuming you're using the Splunk for Windows TA you could use the following query to simply get a count of these events split by user ID:
sourcetype=WinEventLog:Security (EventCode=576 OR EventCode=4672) | stats count by user
... View more