Hello Tim,
Thank you very much for the helpful query.
I would just like to point out that it might be necessary to work on unique 'userid' field values. For example, a similar query is giving me a maximum of 268 'contemporary' users per minute on a given date. Turns out to be 268 '\core\event\grade_deleted ' events triggered by the same IP - some admin deleteing some quiz attempts, I guess.
Thanks