The question mark indicates that the client user name has not been authenticated. This happens when a request arrives from a Firewall client, but the firewall policy does not require authentication. The Firewall client always sends the user name, and therefore it is always logged.

See: http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/faq-monitoring.mspx