Sometimes the audit log shows user creation methods marked as "system" but other times audit log shows user creations using a method marked "Anonymous".

Could this be a plugin that creates users?
Does anyone have an idea of what this could mean?
Could these be REST calls?
Thank you in advance for your answers,
Best regards,
Renaud Daridan