As Sfdcfox says it's being called from somewhere, and your debug logs will help you figure out what's going on.
Additionally, you can download the metadata related to automation into your IDE and do a grep search on the field to see where it's being set. One of those methods/ flows/ etc is being called. the expression would be grep -nire "User__c"
- the
n
option tells grep to return the line numbers
- the
i
option tells grep to ignore the case so USER__C
, uSeR__c
, etc returns a match
- the
r
option tells grep to recursively search the subdirectories
- the
e
options tells grep to use User__c as the pattern
To learn more about grep searches checkout this link