This is a line from my audit log
Guest update option WordPress Address (URL) from https://mysite.com to https://guestsite.com/m99935473; Guest disabled site registration; Guest update option New User Default Role from administrator to subscriber
Someone went in my multisite and changed all the site urls in the database. I had to fix the database first.
I see a bunch of these too:
Guest update option New User Default Role from subscriber to administrator