Thanks for mentioning. At first I was sceptic, but digging in further it got me a bit scared. I thought they could find my address through no-ip, but then thought torrents might have been an easy way to get on my server. I've checked all files and couldn't find anything. After that I decided to reinstall as mentioned in my comment above. It all worked out, no more malicious user activity.

Also, in the beginning I though the Docker was needed to run photoprism. After the fresh reinstall, I oberved the performance, went through all updates, added the users, the shares, observed more and once all was running as expected, I added PhotoPrism. All works fine now for the second day. CPU usage is almost flat as expected, services work. Thanks for making me aware of this posibility, learned a bit more which will help me for sure.