Thanks for the suggestion. There are three Global Catalog Servers in the site. None of them had Kerberos errors at the time Event 8365 from MSExchangeAL occurred. The strongest correlation with Event 8365 is Event 9661 - "The Unsolicited Commercial Email default filter level has been updated. The new value is 4". Every instance of Event 8365 is either closely preceded or followed by Event 9661. Have you checked for this correlation?
Your post referenced "that service" referring, I think, to the MSExchangeAL service. I don't see MSExchangeAL listed among running services, or in any other events besides Event 8365.
