diff --git a/NEWS b/NEWS
index ab9f85d945..4af2fdcdd6 100644
--- a/NEWS
+++ b/NEWS
@@ -92,7 +92,7 @@ Deprecated Functionality
 - The ``EventMgr::QueueEvent()`` and EventMgr::QueueEventFast()`` methods
   are now deprecated, use ``EventMgr::Enqueue()`` instead.
 
-- The ``Connection::ConnectionEvent()`` and
+- The ``Connection::ConnectionEvent()``, ``Connection::Event()``, and
   ``Connection::ConnectionEventFast()`` methods are now deprecated, use
   ``Connection::EnqueueEvent()`` instead.
 
@@ -100,8 +100,8 @@ Deprecated Functionality
   arguments are now deprecated, use the overload that takes a ``zeek::Args``
   instead.
 
-- The ``analyzer::Analyzer::ConnectionEvent()`` and
-  ``analyzer::Analyzer::ConectionEventFast()`` methods are deprecated, use
+- The ``analyzer::Analyzer::ConnectionEvent()``, ``analyzer::Analyzer::Event``,
+  and ``analyzer::Analyzer::ConectionEventFast()`` methods are deprecated, use
   ``analyzer::Analyzer::EnqueueConnEvent()`` instead.
 
 - All ``val_mgr`` methods starting with "Get" are deprecated, use the new
diff --git a/src/Conn.cc b/src/Conn.cc
index aad42b3e42..26fd5a191c 100644
--- a/src/Conn.cc
+++ b/src/Conn.cc
@@ -144,7 +144,10 @@ void Connection::CheckEncapsulation(const EncapsulationStack* arg_encap)
 		{
 		if ( *encapsulation != *arg_encap )
 			{
-			Event(tunnel_changed, nullptr, arg_encap->GetVectorVal());
+			if ( tunnel_changed )
+				EnqueueEvent(tunnel_changed, nullptr, ConnVal(),
+				             IntrusivePtr{AdoptRef{}, arg_encap->GetVectorVal()});
+
 			delete encapsulation;
 			encapsulation = new EncapsulationStack(*arg_encap);
 			}
@@ -152,15 +155,23 @@ void Connection::CheckEncapsulation(const EncapsulationStack* arg_encap)
 
 	else if ( encapsulation )
 		{
-		EncapsulationStack empty;
-		Event(tunnel_changed, nullptr, empty.GetVectorVal());
+		if ( tunnel_changed )
+			{
+			EncapsulationStack empty;
+			EnqueueEvent(tunnel_changed, nullptr, ConnVal(),
+			             IntrusivePtr{AdoptRef{}, empty.GetVectorVal()});
+			}
+
 		delete encapsulation;
 		encapsulation = nullptr;
 		}
 
 	else if ( arg_encap )
 		{
-		Event(tunnel_changed, nullptr, arg_encap->GetVectorVal());
+		if ( tunnel_changed )
+			EnqueueEvent(tunnel_changed, nullptr, ConnVal(),
+			             IntrusivePtr{AdoptRef{}, arg_encap->GetVectorVal()});
+
 		encapsulation = new EncapsulationStack(*arg_encap);
 		}
 	}
diff --git a/src/Conn.h b/src/Conn.h
index a439021f14..161bb6b759 100644
--- a/src/Conn.h
+++ b/src/Conn.h
@@ -193,6 +193,7 @@ public:
 	// 'v1' and 'v2' reference counts get decremented.  The event's first
 	// argument is the connection value, second argument is 'v1', and if 'v2'
 	// is given that will be it's third argument.
+	[[deprecated("Remove in v4.1.  Use EnqueueEvent() instead (note it doesn't automatically add the connection argument).")]]
 	void Event(EventHandlerPtr f, analyzer::Analyzer* analyzer, Val* v1, Val* v2 = nullptr);
 
 	// If a handler exists for 'f', an event will be generated.  In any case,
diff --git a/src/Sessions.cc b/src/Sessions.cc
index 2970a5383f..dc8158ec00 100644
--- a/src/Sessions.cc
+++ b/src/Sessions.cc
@@ -691,12 +691,14 @@ void NetSessions::DoNextPacket(double t, const Packet* pkt, const IP_Hdr* ip_hdr
 	if ( ipv6_ext_headers && ip_hdr->NumHeaders() > 1 )
 		{
 		pkt_hdr_val = ip_hdr->BuildPktHdrVal();
-		conn->Event(ipv6_ext_headers, nullptr, pkt_hdr_val);
+		conn->EnqueueEvent(ipv6_ext_headers, nullptr, conn->ConnVal(),
+		                   IntrusivePtr{AdoptRef{}, pkt_hdr_val});
 		}
 
 	if ( new_packet )
-		conn->Event(new_packet, nullptr,
-		        pkt_hdr_val ? pkt_hdr_val->Ref() : ip_hdr->BuildPktHdrVal());
+		conn->EnqueueEvent(new_packet, nullptr, conn->ConnVal(), pkt_hdr_val ?
+		                   IntrusivePtr{NewRef{}, pkt_hdr_val} :
+		                   IntrusivePtr{AdoptRef{}, ip_hdr->BuildPktHdrVal()});
 
 	conn->NextPacket(t, is_orig, ip_hdr, len, caplen, data,
 				record_packet, record_content, pkt);
diff --git a/src/analyzer/Analyzer.cc b/src/analyzer/Analyzer.cc
index bf93486689..85398f19f1 100644
--- a/src/analyzer/Analyzer.cc
+++ b/src/analyzer/Analyzer.cc
@@ -803,7 +803,11 @@ void Analyzer::Event(EventHandlerPtr f, const char* name)
 
 void Analyzer::Event(EventHandlerPtr f, Val* v1, Val* v2)
 	{
-	conn->Event(f, this, v1, v2);
+	IntrusivePtr val1{AdoptRef{}, v1};
+	IntrusivePtr val2{AdoptRef{}, v2};
+
+	if ( f )
+		conn->EnqueueEvent(f, this, conn->ConnVal(), std::move(val1), std::move(val2));
 	}
 
 void Analyzer::ConnectionEvent(EventHandlerPtr f, val_list* vl)
@@ -935,7 +939,7 @@ void TransportLayerAnalyzer::PacketContents(const u_char* data, int len)
 	if ( packet_contents && len > 0 )
 		{
 		BroString* cbs = new BroString(data, len, true);
-		Val* contents = new StringVal(cbs);
-		Event(packet_contents, contents);
+		auto contents = make_intrusive<StringVal>(cbs);
+		EnqueueConnEvent(packet_contents, ConnVal(), std::move(contents));
 		}
 	}
diff --git a/src/analyzer/Analyzer.h b/src/analyzer/Analyzer.h
index ae80c75de1..859c5400e2 100644
--- a/src/analyzer/Analyzer.h
+++ b/src/analyzer/Analyzer.h
@@ -568,6 +568,7 @@ public:
 	 * Convenience function that forwards directly to the corresponding
 	 * Connection::Event().
 	 */
+	[[deprecated("Remove in v4.1.  Use EnqueueConnEvent() instead (note it doesn't automatically ad the connection argument).")]]
 	void Event(EventHandlerPtr f, Val* v1, Val* v2 = nullptr);
 
 	/**
diff --git a/src/analyzer/Manager.cc b/src/analyzer/Manager.cc
index b74dd28419..c9c3546f60 100644
--- a/src/analyzer/Manager.cc
+++ b/src/analyzer/Manager.cc
@@ -624,9 +624,10 @@ bool Manager::ApplyScheduledAnalyzers(Connection* conn, bool init, TransportLaye
 
 		parent->AddChildAnalyzer(analyzer, init);
 
-		EnumVal* tag = it->AsEnumVal();
-		Ref(tag);
-		conn->Event(scheduled_analyzer_applied, nullptr, tag);
+		if ( scheduled_analyzer_applied )
+			conn->EnqueueEvent(scheduled_analyzer_applied, nullptr,
+			                   conn->ConnVal(),
+			                   IntrusivePtr{NewRef{}, it->AsEnumVal()});
 
 		DBG_ANALYZER_ARGS(conn, "activated %s analyzer as scheduled",
 		                  analyzer_mgr->GetComponentName(*it).c_str());
diff --git a/src/analyzer/protocol/teredo/Teredo.cc b/src/analyzer/protocol/teredo/Teredo.cc
index 26619e92a6..8fbb8eb4af 100644
--- a/src/analyzer/protocol/teredo/Teredo.cc
+++ b/src/analyzer/protocol/teredo/Teredo.cc
@@ -96,7 +96,7 @@ bool TeredoEncapsulation::DoParse(const u_char* data, int& len,
 	return false;
 	}
 
-RecordVal* TeredoEncapsulation::BuildVal(const IP_Hdr* inner) const
+IntrusivePtr<RecordVal> TeredoEncapsulation::BuildVal(const IP_Hdr* inner) const
 	{
 	static RecordType* teredo_hdr_type = nullptr;
 	static RecordType* teredo_auth_type = nullptr;
@@ -109,7 +109,7 @@ RecordVal* TeredoEncapsulation::BuildVal(const IP_Hdr* inner) const
 		teredo_origin_type = internal_type("teredo_origin")->AsRecordType();
 		}
 
-	RecordVal* teredo_hdr = new RecordVal(teredo_hdr_type);
+	auto teredo_hdr = make_intrusive<RecordVal>(teredo_hdr_type);
 
 	if ( auth )
 		{
@@ -201,30 +201,36 @@ void Teredo_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
 		return;
 		}
 
-	Val* teredo_hdr = nullptr;
+	IntrusivePtr<Val> teredo_hdr;
 
 	if ( teredo_packet )
 		{
 		teredo_hdr = te.BuildVal(inner);
-		Conn()->Event(teredo_packet, nullptr, teredo_hdr);
+		Conn()->EnqueueEvent(teredo_packet, nullptr, ConnVal(), teredo_hdr);
 		}
 
 	if ( te.Authentication() && teredo_authentication )
 		{
-		teredo_hdr = teredo_hdr ? teredo_hdr->Ref() : te.BuildVal(inner);
-		Conn()->Event(teredo_authentication, nullptr, teredo_hdr);
+		if ( ! teredo_hdr )
+			teredo_hdr = te.BuildVal(inner);
+
+		Conn()->EnqueueEvent(teredo_authentication, nullptr, ConnVal(), teredo_hdr);
 		}
 
 	if ( te.OriginIndication() && teredo_origin_indication )
 		{
-		teredo_hdr = teredo_hdr ? teredo_hdr->Ref() : te.BuildVal(inner);
-		Conn()->Event(teredo_origin_indication, nullptr, teredo_hdr);
+		if ( ! teredo_hdr )
+			teredo_hdr = te.BuildVal(inner);
+
+		Conn()->EnqueueEvent(teredo_origin_indication, nullptr, ConnVal(), teredo_hdr);
 		}
 
 	if ( inner->NextProto() == IPPROTO_NONE && teredo_bubble )
 		{
-		teredo_hdr = teredo_hdr ? teredo_hdr->Ref() : te.BuildVal(inner);
-		Conn()->Event(teredo_bubble, nullptr, teredo_hdr);
+		if ( ! teredo_hdr )
+			teredo_hdr = te.BuildVal(inner);
+
+		Conn()->EnqueueEvent(teredo_bubble, nullptr, ConnVal(), teredo_hdr);
 		}
 
 	EncapsulatingConn ec(Conn(), BifEnum::Tunnel::TEREDO);
diff --git a/src/analyzer/protocol/teredo/Teredo.h b/src/analyzer/protocol/teredo/Teredo.h
index 55d01b66a2..4abd9483e6 100644
--- a/src/analyzer/protocol/teredo/Teredo.h
+++ b/src/analyzer/protocol/teredo/Teredo.h
@@ -74,7 +74,7 @@ public:
 	const u_char* Authentication() const
 		{ return auth; }
 
-	RecordVal* BuildVal(const IP_Hdr* inner) const;
+	IntrusivePtr<RecordVal> BuildVal(const IP_Hdr* inner) const;
 
 protected:
 	bool DoParse(const u_char* data, int& len, bool found_orig, bool found_au);
diff --git a/src/analyzer/protocol/vxlan/VXLAN.cc b/src/analyzer/protocol/vxlan/VXLAN.cc
index 7e894019ca..2af72887f7 100644
--- a/src/analyzer/protocol/vxlan/VXLAN.cc
+++ b/src/analyzer/protocol/vxlan/VXLAN.cc
@@ -101,8 +101,9 @@ void VXLAN_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
 	ProtocolConfirmation();
 
 	if ( vxlan_packet )
-		Conn()->Event(vxlan_packet, nullptr, inner->BuildPktHdrVal(),
-		              val_mgr->Count(vni).release());
+		Conn()->EnqueueEvent(vxlan_packet, nullptr, ConnVal(),
+		                     IntrusivePtr{AdoptRef{}, inner->BuildPktHdrVal()},
+		                     val_mgr->Count(vni));
 
 	EncapsulatingConn ec(Conn(), BifEnum::Tunnel::VXLAN);
 	sessions->DoNextInnerPacket(network_time, &pkt, inner, estack, ec);