Remember that there are many logon types availables, maybe what you are seeing are network logons triggered on the AD or maybe file sharing among the network. I recommend you to use more filters for this report, for example if you want to check all the interactive logons (when user actually type on the keyboard for login) use the logon_type field.
Let us know what exactly you want to see on the report, interactive logons? rdp ? network ? etc.
Now that you've said it, it seems obvious
That seems to have done the trick, thanks for your help