It all seems reasonable to me. For context, I briefly logged into my test site today through the DiscourseHub app. The site has almost no content. I browsed around it for a few minutes and generated 36 User API requests. On a site with lots of content to scroll through, it wouldn’t be unreasonable for a single user to generate a lot of requests over a day.
If you’re still concerned about this, it would be possible to use the Data Explorer plugin to look at user activity for the users whose user_id were returned from this request:
SELECT * FROM user_api_keys