Security logs from two routers show the same event several minutes apart. Which service should be checked first?

1. NTP synchronization
2. DNS round-robin records
3. OSPF equal-cost paths
4. DHCP lease expiration