A large majority of 4XX responses can be an indicator of malicious activity. Under normal operations it is common for some requests to be made incorrectly or without proper authenticatkion. A majority of requests receiving 4XX responses means that the service is being misused or abused.
An attacker can try to log in with a large number of username and passwords that leaked in some unrelated incident. This is called credential stuffing and it will generate a large number of failed requests.
