Any npub that publishes on public nostr relays is counted. If there was a spike in some space that is bridged to nostr then it could be the source of the spike.