Just realized this is probably a monster of my own making. I have a MacOS Sierra VM that I created from a clone of my old laptop. These AppleID alerts seem to correspond with two times I recently accessed it, so the VM probably still has the old AppleID, even though I never use any iCloud services on it. Interesting that the alerts came from the host Mac and not the VM though.