auditing

I have two 2003 DCs in a Windows Server 2003 environment, rubble and ashes.

rubble is doing proliferous logging of success "logon/logoff" security
events. ashes only logs failure logon/logoff security events, which is what
I want.
rubble has no "account logon" events, but I assume that's because ashes is
the PDC emulator master, which does have account logon failure events.

I've checked all the GPOs, including the domain controller security policy
on both DCs, and there is no "logon/logoff" auditing policy set. Why would
rubble be logging them, or how can I see the internals of how this is
happening? I've tried the RSOP tool, but no matter what I do with it, it
tells me that such events are not logged on rubble. The problem is that
these success logon/logoff events occur dozens of times per second and I'd
like to recover some system performance. I've even tried setting the
auditing for the appropriate events to Disabled in GPOs, but it doesn't seem
to have any effect in stopping these events.

Thanks,
Dave