Oh, that's why last_access always lags by less than a minute. First_access, however, varies wildly. I remember seeing forum posts about that - I'll look it up.
For reporting, I'm going to use separate summary tables created - and progressively updated (2 to 6 times a day) - from mdl_log and related tables. These summary tables would store aggregated data specifically for a set of predefined reports. No *.* rogue db queries allowed
So only the latest unsummarized records from mdl_log (and cousins) would be processed a few times a day.
I'd done this a while ago in m1.9. The reports didn't have right-now info, but a "Report data as on <timestamp>" caption was fine with the big brothers. And, for those who couldn't wait, a couple of adhoc-query-powered Certified/Not Yet Certified-type reports maintained a reasonable level of contentment...