In the attached picture, the cluster log field contains the messages "successful @ auth for user 'root @ pam' which occurred late.
Did someone get access to proxmox at this time?
can you review, please?
Did you keep the webinterface open? As it renews it's login about all 15 minutes, and a renewal is logged as login (as from that point on the returned "Access Ticket" for login is valid for 2 hours). As your logins happen all with an interval of about 15 minutes, I'd guess it's that.