Why and for what possible reasons 'sa' gets locked?
When you look at the General tab in the Login Properties of the sa account, you will notice different settings. One of them being Enforce password policy.

I discussed this setting in my answer to the question How to lock a sql login after N unsuccessful login attempts.

Possible reasons for change in lockout behaviour

If you previously didn't have an Active Directory policy for locking out accounts, then  ...


... the user's inability to use the correct password had no adverse effect on the sa account (No locking of sa account)  
... the hacker was able to enter multiple passwords for the sa SQL Login until he had access. (No locking, but hacker in system)  
... it didn't matter if any script, program, user, system used a wrong password for the sa account.  


If you changed the Active Directory policy recently to lock accounts after n wrong password attempts or if you reduced the number of wrong password attempt to cause a lockout, then you might be encountering a locked sa account due to ...


... the user using the sa account is unable to enter the correct password after n attempts, which results in a lock out.  
... the hacker is unable to gain access again, which results in a lockout.  
... somebody is just having fun locking out the sa account.  


Recommended actions


Change the password for the sa account to ensure nobody gains access to the server via this account.  
Ensure that the option Failed logins only is enabled at server level in the in the Server properties - xyz | Security tab | Login auditing section . (Better: If you have enough space for your ERRORLOG and are cycling the ERRORLOG at a regular interval, set it to Both failed and successful logins.)

Check the SQL Server ERRORLOG file for login issues and track down who is behind the IP address in the error message.


2017-07-21 09:58:12.48 Logon       Error: 18456, Severity: 14, State: 8.
2017-07-21 09:58:12.48 Logon       Login failed for user 'sa'. Reason: Password did not match that for the login provided. [CLIENT: ]


this example was from the same host, hence no IP address