How can I hunt down what is trying to use SA?
To track login failure reason SQL Server Profiler would be a good option. One can also use extended events trace to capture login failed events and reason behind the failure.

You need to first launch SQL Server Profiler.Create a new template or you can use existing one if you have already. Please include below when creating the trace

1.Audit Login Failed (under Security Audit)
2.User Error Messages (under Errors &amp; Warnings)
3. Errorlog (under Errors &amp; Warnings)


Then clear the Show All Events tick box and select following columns

TextData
SPID
ClientProcessID
Hostname
LoginName
NTUserName
NTDomainName
ApplicationName
DatabaseName
Error


More details can be taken from This Link and This Link

To read more about SQL Server profiler refer to this Microsoft Online Doc