Hello,
When a user first accesses the SAP system through HTTP, a session like the ones you describe will appear at SM04. This is because no login took place yet. Thus, the system cannot display a user ID.
The fact that you have several entries like this tells me that something / someone is opening several connections, but not performing the login.
You have also mentioned that the entries are cleared after 3 hours. This would be the parameter "rdisp/plugin_auto_logout" doing its job.
This would not be exactly an issue. So far, it is normal behavior.
The questions would be what / who is opening such connections and not performing the login, and why.
Regards,
Isaías