sys.aud$ connection that is clearly coming from a privately owned database link in a downstream data

In my sys.aud$ I found a connection that is clearly coming from a privately owned database link in a downstream database.  Normally, all these connections show the aud$.userid as the link owner.  My problem is that I have found connections that have the userid as SYS.  They are showing in my audit and I can't track them down.  How can a SYS connection come from a private owned link?