So there's a few ways to tackle this.

$User = "username"
$DomainControllers = (Get-ADDomainController -Filter *).Name

foreach ($DC in $DomainControllers) {
    Get-WinEvent -ComputerName $DC -FilterHashtable @{
    LogName = 'Security'
    ID = 4624
    Data = $User
} | ForEach-Object {
    $ip = $_.Properties[18].Value
    $hostname = $null
    try {
        if ($ip -and $ip -notin @("::1", "127.0.0.1")) {
            $hostname = [System.Net.Dns]::GetHostEntry($ip).HostName
        }
    } catch {
        $hostname = $null
    }

    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        SourceIP    = $ip
        Hostname    = $hostname
        DC          = $DC
    }
}

}

That will display recent authentications to the DC. You can use a script that loops through all computers in AD and uses the quser command to see where they are actively logged in, but if you have a large environment, this will take a really long time to run. I have around 2300 machines, so I would never do this. However, if you have some idea of where it might be, you can target an OU with that. Example, you know it's one of the application servers and you only have a handful of those, you can quser each AD computer in your app server OU.

A more helpful approach if it is an issue you're dealing with right now is to look at recent lockout events. If a user is telling me that their account keeps getting locked out and I just unlocked the thing 10 minutes ago, then I do this instead, which is super helpful:

$Minutes = 20
$Since = (Get-Date).AddMinutes(-$Minutes)
$DomainControllers = (Get-ADDomainController -Filter *).Name

$results = foreach ($DC in $DomainControllers) {
    Get-WinEvent -ComputerName $DC -FilterHashtable @{
        LogName = 'Security'
        ID = 4740
        StartTime = $Since
    } -ErrorAction SilentlyContinue | ForEach-Object {
        [PSCustomObject]@{
            TimeCreated      = $_.TimeCreated
            User             = ($_.Properties[0].Value)   # Locked out user name
            CallerComputer   = ($_.Properties[1].Value)   # Source of lockout
            DomainController = $DC
        }
    }
}

$results | Sort-Object TimeCreated -Descending | Format-Table -AutoSize

This shows me every account that was locked out in the last 20 minutes (adjust time for whatever you need). It will show you the DC that performed the lockout and which computer triggered it.