I realised this was a regression I introduced in July while solving a different last_seen bug. API and User API access should not update last_seen, and therefore should not create a visit record. Should be fixed by:
https://github.com/discourse/discourse/commit/56e0f47bcd183f9d8e5cde853bcb9f8fe38eebf7