I think the most probable answer is that whoever controls Zencloud is dumping stake. There's a big difference between the stake rate of hashstakers and the stake rate of a prime controller. Those transfers out could easily be stake going to a set of wallets, then either being withdrawn by hashstaker owners or dumped on an exchange. It's a mix, which is why it looks like a jumble.

That's also why the numbers wouldn't add up. Only some of the transfers are to ordinary users. Whoever controls the Zencloud wallet ('mk', I guess, though I haven't checked the sig) could easily be both dumping and filling user accounts. There's enough stake for both.