Defender lockouts and Audit logging

Login lockout seems not to lock logins attempts. I have the standard setup: 5 fails / 300 seconds lockout. But in the log, I have a lot of fails from the same IP (like 10 every minute).

Also, the Audit Logging is not working and displays an error message:

"Whoops, Defender had trouble loading up your event log. You can try a quick refresh of this page or check back again later."