MFA Failure Log Analytics

Hi ,

I would like to know how it happens to have "Failed log on (Failure message: Strong Authentication (second factor) is required)"  while in the activity logs there is no log on attempts or Multiple failure log on attempts before the MFA failure and you can see bunch of sharepoint access file ?

I've seen this situation so many times and I confused.