I'm not aware of any way to entirely stop this. However, they can be more common in the following scenarios:
Too many connections on a single external IP address - consider using multiple external IPs and pushing some users out on one IP and other out of another.
SSL inspection - so for content filtering. In the past we use to get them a bit from Securly - but they rotate IPs so much now its not an issue.
Something spamming Google on your network with login attempts - i.e. well beyond the normal.
However, if someone just gets a password wrong a few times it will happen and nothing you can do about it.
Roger