Whenever a license is removed from an existing account, this event will trigger. Removing user licenses is a good way for hackers to disable users.
Remediation
Repeated license removal, or license removal from key users in your organization should be investigated and the account from which the action is taken should be disabled. We recommend looking at the Microsoft 365 Audit Logs. There are two places where a user can remove a license, through the Microsoft 365 Portal or with the Azure AD portal.