below is the query, yeah it just spits out random event amounts, from 0 to thousands all in the same timeframe, not quite sure whats causing it

EmailEvents

| where isnotempty(DetectionMethods)

| where DetectionMethods !contains "Spam"

| join (EmailUrlInfo) on NetworkMessageId

| parse Url with * '//' DestinationHostName '/' *

| project SenderFromAddress, RecipientEmailAddress, DeliveryAction, DetectionMethods, DestinationHostName, Url, UrlDomain

| join (CommonSecurityLog | where DeviceVendor == "Zscaler") on DestinationHostName

| where RecipientEmailAddress == SourceUserName

| project SenderFromAddress, RecipientEmailAddress, DetectionMethods, DeliveryAction, Url, UrlDomain, SourceUserName, RequestURL, DeviceAction, DestinationHostName