forgot to specify: these are LDAP users
if the profile being created counts as an activity, then that explains it - our users are automatically created and enrolled into a course by an interface with our database system - so maybe these are users that were created/enrolled, but never actually logged into moodle?
i guess that makes the most sense, thanks for getting me on the right track