Thanks for letting me know - it was a couple of https://dlease.io delegations - ctime often requests leases on DLease with high APR, high amounts, and/or long durations - so a lot of people might delegate to them unknowing of their problematic nature.

I have removed my delegations to them now :)