On Friday we had a massive wave of AD lockouts- almost domain wide. What could have happened? It went from a normal Friday to hell in an instant with almost all users calling in when their accounts got locked out.

Not seeing anything on the DC that indicates anything strange, not seeing anything weird on the firewall. After rebooting the DC, all seemed OK. 

Might be time for that DC to get a rebuild.