I think this is some sort of hiccup between the client and the domain controller
I'd say your hunch is correct, as error 1789 means: "The trust relationship between this workstation and the primary domain failed."
Thanks for the reply. Now trying to replicate the issue or find a correlation in the splunk logging.
Maybe you got some tips how to troubleshoot this?