Course statistics report shows "guest" activity even when guests are not allowed (weird aggregation of grade events)

The course statistics reports shows "guest" activity for actions that were taken by the system, e.g., (automatically) updating an aggregated grade as the consequence of a (manual) grade change. This affects "Reports > Statistics", but might be visible in other reports, too.

We realised this by looking at statistics of a course that had high interaction by guests, even though guests were (definitely, we checked) not allowed to enter the course. Statistics looked like this (guest = orange):

After some investigation, we found some artificial grading events to be the cause. Those events were attributed to user id -1 (meaning: System user - USER_OTHER in \core\event\base). I suspect code such as that in https://github.com/moodle/moodle/blob/a63cd3e2ca8f864a832c5e050677acbf1bda1701/lib/statslib.php#L493 might be the reason, because a user "-1" is definitely never enrolled in any course - but I don't know if that is the actual root of this particular issue.

Expected behaviour:

• Attribute actions only to guests if they were performed by actual guests
• Do not show system user actions in this graph

Steps to reproduce:

1. Create a course with an activity
2. Enrol a user as a student into the course
3. Make sure guest access is disabled for course
4. As an admin/teacher, go to the grade report and override the grade for the user for the particular activity
5. Update your system time to day+1 - Needed to do this so it would be picked up in the stats report mentioned
6. Run 'stats_cron_task'
7. Go to the course's "Reports > Statistics"
8. Notice 'Guest' activity in the graph and table below.