You would like to know why there are multiple event id's in each option in the detection policy for failed logins.
DCS 6.x Detection Policy
Windows Agents
These dual entry's are for backwards compatibility with older OS's.
Windows 2003 and XP generates event id 529 for a login failure. The newer Windows OS's that same login failure is event id 4625.
The event id's in the rule are an OR statement, so either can match depending on the OS. You can change these to remove one or the other, depending on the Windows OS you are using.