Auditing disabled but still getting audit trail entries

Hi all ... I have a weird thing happening with audit trail and can't find an answer anywhere, hope someone here can suggest something:

Some weeks ago, I set up auditing by issuing "audit insert table by access by <user> whenever not successful" and began getting audit trail entries for failed inserts.    I did this for three different users (while connected sys as sysdba).     I had also done "alter system set audit_trail="db_extended".      During the time this audit was in place, if I queried dba_stmt_audit_opts, and other views, I'd get the expected results.

Now I've finished with the audit, I issued "noaudit insert table by <user>" for each of the three users, and as expected, there is nothing in dba_stmt_audit_opts, or any of the other relevant views.     However I'm still getting entries in aud$.   It's not the thousands per day that I used to get, it's only two or three per day, and the userid is NOT one of the three I had originally set up auditing for, and what's even more odd is that the audit entries are for successful inserts, when I'd only ever requested auditing on failures.  I know for