Could also be a nicehash user. Or someone remotely changing config files.
To anyone worried about remote changes, set -mport 0 (disable), or -mport -3333 (negative ports make remote monitoring read only), default is 3333 (full remote access via ethman).
You can also go here
https://www.grc.com/x/ne.dll?rh1dkyd2 to check if port 3333 is open to the outside world, and change router settings if it is.
Looks like a gpu farm, all the worker hash rates fall in line with what you would expect of a rig.