Something to keep in mind is that the plugin service doesn’t really do very much by itself. The main purpose of the plugin service is to invoke and provide credentials to plugins. The plugins then use those credentials to do whatever they were designed to do.
So the first step would be to outline which plugins you have installed and which ones are running when you’re seeing the logins in the audit log.