Kerberos Event ID 4771 (0x18) occurring for all domain users despite successful manual logons

Failure code 0x18 normally indicates that Kerberos pre-authentication received an incorrect password. Since interactive logons work but failures continue in the background, I would look for stored or stale credentials rather than Kerberos tickets.

klist purge will not solve this because it removes issued Kerberos tickets; it does not stop a service or scheduled task from repeatedly trying an old password.

Start with the Account Name and Client Address fields in each 4771 event. On those source systems check scheduled tasks, Windows services, application pools, Credential Manager, mapped resources, monitoring/backup agents and proxy authentication.

I would especially investigate the proxy because you mentioned failures from that system. Correlating the timestamp, account and client IP should quickly identify which process is generating the requests.