Might be this is due to the Spam. Diable use registration under the
General -> Settings if you don’t need registration on the front-end or use the
captcha or other
spam protection plugins.
Regarding the backend -> Have you checked the wp_usermeta table if any role assigned to those users or not? Check user roles for those users.