First of all - it might not be anybody accessing your eventlogs remotely. Eventlog files are always open. They are memory-mapped files, so you can't just delete them from the disk.
If you need the disk space, you need to open eventvwr.msc and alter the maximum size of the log file there. The change won't take effect until the next restart of the eventlog service (which will probably be when you reboot the machine).
If you want to clear the logs (ie remove the data), you can also do this in the eventvwr mmc snap-in.
If you have a need to keep eventlogs in a deletable file, you can use the AutoBackupLogFiles registry key, but the memory-mapped files will still remain.
If you still suspect that a user account is accessing the eventlog on your computer remotely, and this includes the security log - you should check the security log for events with ID 4672, and look for accounts logging on with SeSecurityPrivilege enabled.
If you don't think the security log is the one being accessed, you can still look for events in the security log with ID 4624, which should show you who has been accessing the computer remotely (but will include all users, not just the one/ones accessing the eventlogs). This should at least narrow your list of suspects.
You could always use wevtutil to add an audit SACL to the logs which you think are being accessed. The process is much the same as for adding permissions (DACL), except you're saying which things should be audited, as opposed to allowed or denied.
Slightly less elegant, but when you notice a connection from the remote IP, you can try running qwinsta /server:remoteIP. This will show you who is logged on at that computer, either locally at the console or via terminal services. It won't help if the "user" is a service account or a scheduled task.