The error simply means that someone / something is trying to connect to the sa account from the IP address 172.16.30.227 but with an incorrect password.
SQL Server has just rejected the connection, and as far as SQL Server is concerned, this is the end.
In the SQL Server logs, you will not find any more information that will help you find out who or what wants to connect.
You can try to log on to the computer 172.16.30.227 and check scheduled tasks or the event log to get an indication of what failed there.
If it is an IP address that you know (for example, the server itself), it can be a script or a tool that was scheduled before the sa password change, or it could be something that has never been configured correctly.
If it is an IP address that you do not know or is a workstation on your network, it can be a malicious user trying to sign in.
The only thing you can tell from the SQL Server logs, other than the IP address, is whether there is a recurrence pattern on the day or time the error occurred.