I've done something interesting to figure out this problem, because the dump didn't really tell me all that much. I went to your provided $evtx_sys and checked for Events that had words like Error
, in them. Here's an interesting Event that I've found.
Log Name: System
Event ID: 4321
User Name: N/A
The fact that NetBT is reporting, isn't that important at all. What's important is that this typical Event ID, is related to Symantec Ghost as you've mentioned. Symantec Ghost picks up on NetBT, and make like an image copy of itself, and duplicates. Duplication is this type of Ghosting, means you'll have the same name in both of them - which NetBT isn't liking at all.
I'd recommend not using Ghosting at all at this moment. You might look for other software, unless you can configure your Ghosting so you won't experience this problem. I do not have any type of experience with this, so you can pretty much decide what you want to do. All I know is that, there's a pattern between this Event ID, and your Ghosting environment.