Overview:
The user security profile and Federated ID are changed by the system.
Root Cause:
The user record is showing as modified by the System is because the modification of the user happens as part of a separate Vault. The fields for all of the users are updated by another user in another Vault.
Solution:
This is working as designed. The reason this is done is so user's names are not displayed in Vaults which they are not a part of.
Related Documentation:
Vault Help Documentation: N/A