Umbrella is unable to identify end-users properly, and it looks as though the mappings are jumping across IP addresses.
Each Virtual Appliance builds a table of mappings between users, machines, and their known IP addresses. It has a function that will "collapse" entries in this table if it sees logon events common across more than one IP. In cases where shared systems generate a large number of logon events across multiple users, those collapsed entries can "drift" their assignment to different users unexpectedly.
The solution is to simply exclude shared systems from the Connector by their IP address so that it doesn't push these events to the appliances. In Deployments > Configuration > Service Account Exceptions, add the appropriate exception as an IP address.
IP mappings can be cleared from each Virtual Appliance using 'config admap' as seen here: https://support.umbrella.com/hc/en-us/articles/360032822252-Virtual-Appliance-Commands#config