SA account locked out then unlocked somehow
Thanks Ross and James for input in the comments. I found that our sa account has enforce password policy turned on, and our local security policy will unlock an account after 15 mins, so that answers how it got unlocked. Regarding future I think server audit of login failed event class will help us catch more information if this happens again. Internally we have a goal to move away from using sa and rename/disable it.