This is normal behavior for IIS. You are seeing a 401 because the first request from a user comes in unauthenticated, IIS then responds back and says the request was not authorized (hence the 401) and then tells the client what options they have to authenticate. These 401's are not really extraneous, they are a fact of the HTTP request/response process when authentication is required.
What you can do is use IIS's Advanced Logging to filter out the 401's in another log file. The problem with this that this would filter all 401's. IIS.NET has a good article that explains how to create a filtered log. Advanced Logging has a lot of other features that may also interest you if you are wanting to customize what kind of things get logged.
Nevertheless, your default IIS log will still contain every request...even the 401's.