I've seen the same behavior on my network where I use a GPO to put the company logo as the background. It seems to happen when a computer crashes and they get the active desktop recovery upon boot.