What's default client frequency contacting DC via Kerberos?

Hi All,

I trying to understand what happening in the router logs, it seems that a lot of windows client is contacting to DC via port 88 (kerberos)

How often should these clients contact the DC actually? Could be this a sign of malware?

Thanks