Event ID: 6005 & 6006 -

Getting the following application event log warnings but can't seem to trace where they are coming from.  Have tried unlinking all GPOs & GPPs but that doesn't seem to stop the warnings.  Any suggestion how we can trace the source of these.

Thanks,

Log Name:      Application
Source:        Microsoft-Windows-Winlogon
Event ID:      6005
Description:
The winlogon notification subscriber <GPClient> is taking long time to handle the notification event (CreateSession).
Additional details:
 Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}"
 EventSourceName="Wlclntfy"

Log Name:      Application
Source:        Microsoft-Windows-Winlogon
Event ID:      6006
Description:
The winlogon notification subscriber <GPClient> took 66 second(s) to handle the notification event (CreateSession).
Additional details:
 Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}"
 EventSourceName="Wlclntfy"