PROPFIND is used by clients to retrieve changes - this happens especially (much more) often if there is no HPB in place - in this situation every client performs a PROPFIND every 30 sec (I think). so a client (e.g. browser session etc) with outdated password could result in repeated login failed messages and could trigger bruteforce protection as well.
As first step I would analyze the logs of your reverse proxy to identify faulty client, once you isolate this client you could verify your reverse proxy config and ensure right headers are forwarded and trusted by NC e.g. X-REAL-IP and X_FORWARDED-FOR so you can differentiate the clients in the application.