All dc's in the domain can service login requests, workstations will tend to use the previous dc that they successfully authenticated with and if that's nit available or there is a dc that responds quicker then they will use whichever dc is nearer/ replies the soonest.
for your audit trail, you would be better setting up a share that is always available rather than using %logonserver% which couldbe any dc in your domain.