We appear to have a problem where agents are sending multiple scans every day.
Core server 8.7 SP5
The client is configured to process a scan, on login and once randomly during the day and the on IP change (for VPN users, as the logon scan does not get sent to the server), however, we have approximately 5500 machine and within 3 hours in the morning have in excess 18000 scans which remain at that level throughout the day, all scan do get processed so I would guess that everyday we receive in excess of 25,000 scans.
It has also been noted that on some machines ldiscan runs 3-4 simultaneously on logon despite it been in the registry once.
Don't bother with the login scan. Unless there is specific user info you need to get immediately, then the normal locallyu scheduled one should do. What you are probably seeing is all of these scans gathering together. Run at login, run at scheduled time (not able to run, so wait till it can), and ip address change.
Also, test your vpn clients to see if they really need the ip address change scan because normal practice if the scheduled scan can't run is to wait till connection is available and then it will run.