Strange activity for Discovered apps in MCAS

Hi, 

we are seeing some strange activity through MCAS on applications that users confirmed they have not logged into using company devices. 

SnapChat is showing as having a peak of transactions/uploads on a specific day for several users (2 incidents attached) but both confirm they have not used the application - especially as the time frame appears to late on a Friday night. 

What is generating this traffic? It is concerning MCAS can be so far off the mark and definitely leads to trust/integrity issues with the data!