You might be looking at the wrong line in the logs. I'd look for a line with "retcreds" to determine the actual error. The line will indicate the credentials being used and the resulting authentication error. Perhaps 1326?
I find it odd that 1 IP is fine, but multiples are not. I'd suggest you open a support ticket and send a full support package and indicate the date/time of scan with Single IP and date/time of scan with Multiple IPs so we can compare.
If you dont have portal access, please contact your organization's help desk.
Thank you.