Event 4624 on the DCs captures where the account is being logged on, and what logon type it is (interactive, network, etc) which should at least help narrow down where scheduled tasks or logons are firing off. Then you need to do your analysis per computer.
If you don't have a SIEM tool like Splunk or a security analysis tool like Netwrix Defender that can capture logs off all DCs (and even better, all computers), one thing you can do is use the Event Log Collector service to set up subscriptions to forward specific log events from all the DCs to a collector server.
There are third party Windows sysloggers that can do a similar thing.
To target a specific account logon event, you can use this XPath filter:
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
*[System[(EventID='4624')]
and
EventData[Data[@Name='TargetUserName']='My_BadAcct']]
</Select>
</Query>
</QueryList>
Another, cruder, method might be to do an Event Viewer Task in Task Scheduler on each DC, using the event filter above as a trigger to fire off a Powershell script to do something like log the event details into a text file. There's a brief example here (last item) on how to capture event details and pass them through as variables to the script.
On a procedural note, if you think you've found nearly all of all the places where the account is used, but are having real issues identifying the last one, the easiest thing to do is simply disable the account. The calls to IT support will quickly resolve who needs it. (Known as the "scream test".)
In the event you're still getting "mystery" logon attempts to the disabled account and no-one gets in touch quickly, it's best to leave it disabled for at least a year, in case it's the account that runs the end-of-year financial reports. Or half a year, if you using the standard retention time in your AD Recycle Bin.
