Those are log messages generated by pam_winbind because it's in the PAM configuration for your server, winbindd is stopped / unavailable, and "verbose logging" is enabled in your Active Directory configuration. If you disable "verbose logging", the alerts should not appear.
I've had multiple alerts for SSH login failures, but I don't have the SSH service enabled. I also had this same issue on another TrueNAS server.
WARNING
3 SSH login failures: Apr 12 18:35:52 freenas 1 2021-04-12T18:35:52.731251-05:00 freenas.MORTARI.NET su 1955 - - pam_winbind(su): request wbcLogoffUser failed: WBC_ERR_WINBIND_NOT_AVAILABLE, PAM error: PAM_AUTHINFO_UNAVAIL (12)! Apr 12 18:35:52 freenas 1 2021-04-12T18:35:52.731264-05:00 freenas.MORTARI.NET su 1955 - - pam_winbind(su): failed to logoff user ntpd: WBC_ERR_WINBIND_NOT_AVAILABLE Apr 12 18:35:52 freenas 1 2021-04-12T18:35:52.731269-05:00 freenas.MORTARI.NET su 1955 - - pam_winbind(su): request wbcLogoffUser failed: WBC_ERR_WINBIND_NOT_AVAILABLE, PAM error: PAM_AUTHINFO_UNAVAIL (12)!
2021-04-13 00:00:05 (America/Chicago)