Hi,
Just check if there are scheduled bulk import or export ports which is causing this.
Try and disable syndication ports (Or suspend Syn server), also see if there are bulk imports which are in place and last check MDM workflow if there are getting triggered.
And most importantly close portal connection via code after user is inactive after a period of time (say 5 mins) or else the active session's also can cause the issue.
The above can be some causes for the abnormal behavior.
Regards,
Sai Charan.