I'm analyzing this event right now - it appears to me that, especially if the target server name is "localhost", that anything else from this event already exists in a corresponding EventID 528. For example,
EventID 552 EventID 528
Logged On User: Username = Caller User Name
Logged on User: Domain = Caller Domain
Target User Name = User Name
Target Domain = Domain
Thoughts?