A colleague of mine Dirk van Coeverden has written an excellent article about troubleshooting OpsMgr 2007 Event 21402. With this article you can see how you can use the Workflow name from the Event details to trace which rule/discovery/monitor is causing