I've been getting alerts almost every week that someone's trying to access my account from random locations. I've already changed my password twice this month and enabled 2FA, but it keeps happening. Am I being targeted or is this normal?
This sounds like your password might've been compromised in a data breach somewhere, which is why you're seeing attempts even after changing it. The good news is that 2FA basically blocks these attempts from succeeding, so whoever has your old password can't actually get in - are you checking to see if any of these login attempts actually succeeded, or is Google blocking them all? If they're all blocked, you're fine security-wise, but I'd run a password manager and change your Google password to something totally unique that you haven't used anywhere else. You could also check your Google account's security page to see which devices have active sessions and boot out anything unfamiliar.
If you've already got 2FA enabled and they're still coming through, those attempts are almost certainly hitting a wall - the attackers can't actually get in. Check your Google Security Checkup to see if any apps or devices you don't recognize have been granted access to your account; sometimes people miss revoking access to old phones or email clients they've ditched. Also worth running a malware scan on whatever device you use most often, just to rule out something on your end sending out your login info automatically.
Have you checked whether your email address shows up in any known data breaches? That's usually the culprit - your password gets leaked from some site you used years ago, and now bots are just hammering Google's login page with it, but they can't get past 2FA so you're safe even though the alerts are annoying.
I dealt with something similar a while back where I kept seeing login attempts from Russia and China, and it turned out my email had been in at least three different breaches I didn't know about. Once I ran a quick check through a breach database and changed passwords on the compromised sites, the alert frequency dropped way down - not because Google stopped the attackers, but because there were fewer old passwords floating around for them to try. So yeah, change your passwords on any accounts where you reused that same password, then just ignore the alerts; they're actually proof that 2FA is doing exactly what it's supposed to do.
Log into answer.
