Hi,
So my first propositions seem to be the correct ones:
Or it could be that your email client scans for the links in the emails for security and thus trigger the activation.
Or it could be that your browser preloads the link data before you click on on it for speed and thus trigger the activation before you use the link.
Either way, not much you can do to avoid that as the problem is on the computer of the user, not on your website.
A solution to avoid that would be to change the way the confirmation works by having the customers enter a code manually after clicking the activation link.
But I don't think it makes sense to go that far and make it more difficult for almost everyone else for a few users.