Audited user alert being raised despite not being set in EM

We are getting alerts from OEM for thresholds we don't have set. The audited user alert is the prime example of them. There is no value in either the warning or threshold fields and, later, the collection of this metric was disabled. We still get messages that audited user "SYS" is logging in from somewhere. AUDIT_SYS_OPERATIONS is false.

We originally opened this as SR 3-8734348111 then Oracle spun it off to SR 3-8781376881. The various engineers are going around in circles and not addressing the issue. We felt we'd try the community to see if anyone else had this issue.