Resource access activity

Where can we find more info on the following activities logged by Azure ATP? What is the difference between those two:

Resource access: device xxxx, property xxxx/xxxx

Resource access: property Spns xxx/xxxx, user xxxx

What could cause a lot of these activities by one user? Can this indicate kerberoasting? https://www.eshlomo.us/kerberoasting-extracting-service-account-password/