User_added/user_removed events? Why?

Configuration
1

I noticed user_added events while I was looking at the type of events that are logged. I am wondering under what condition these occur. The events are a split of a second apart. From a paranoid perspective these are users that are added by a hacker to perform some operations, but if someone were to obtain the cert to my ssh and private key password, then why use HA to perform operations?

I am currently assuming this is HA doing some background work, however I need to ensure the system is not compromised. Any ideas?

home-assistant=# select * from events where event_type like 'user_%'
home-assistant-# \g

 event_id |  event_type  |                   event_data                    | origin |          time_fired           |            created            |            context_id            | context_user_id
----------+--------------+-------------------------------------------------+--------+-------------------------------+-------------------------------+----------------------------------+-----------------
   774874 | user_added   | {"user_id": "cfb62151c0eb4a7aa2b2b8727d4b728a"} | LOCAL  | 2019-06-04 04:36:05.938884+00 | 2019-06-04 04:36:05.942436+00 | 3b0ae2773ffa4a699fc94c37527f718a |
   774875 | user_removed | {"user_id": "cfb62151c0eb4a7aa2b2b8727d4b728a"} | LOCAL  | 2019-06-04 04:36:05.977822+00 | 2019-06-04 04:36:05.981319+00 | e1df5cbb588d4ac6813a5c8218d03ef2 |
   774885 | user_added   | {"user_id": "5cc2f49336b54324a2c794de86a17591"} | LOCAL  | 2019-06-04 04:37:06.85281+00  | 2019-06-04 04:37:06.859494+00 | 21cb504afce94c3a83c2314030040463 |
   774886 | user_removed | {"user_id": "5cc2f49336b54324a2c794de86a17591"} | LOCAL  | 2019-06-04 04:37:06.898512+00 | 2019-06-04 04:37:06.904854+00 | f56727bd7a26434d968d91b9a13e16e2 |
   774890 | user_added   | {"user_id": "8c9276f9c85947f7bf648eb6972c6235"} | LOCAL  | 2019-06-04 04:37:10.452684+00 | 2019-06-04 04:37:10.479782+00 | c9381be071f0468b9f38cd48750be572 |
   774891 | user_removed | {"user_id": "8c9276f9c85947f7bf648eb6972c6235"} | LOCAL  | 2019-06-04 04:37:10.499403+00 | 2019-06-04 04:37:10.502882+00 | d3e0bef7d68c482eb211754521f6e394 |
(6 rows)
2

Can it be that thereā€™s some component doing this?
I have absolutly no such event in my db.
Maybe query the states table for the event_idā€™s?