Yes, can confirm, groups are enumerated all day every day, so this traffic is relatively normal. If you are concerned: you can look to bring in AD information: https://splunkbase.splunk.com/app/1151/#/overview and then look for any logins (4624, 4768,4776,etc.) searching for the disabled users.
... View more