The user security profile and Federated ID are changed by the system.
The user record is showing as modified by the System is because the modification of the user happens as part of a separate Vault. The fields for all of the users are updated by another user in another Vault.
This is working as designed. The reason this is done is so user's names are not displayed in Vaults which they are not a part of.
Vault Help Documentation: N/A