Recently we have hit the API call governor limit and since then we are looking at the administrative report 'API Calls Made Within Last 7 Days'.
The Salesforce documentation states
What counts towards my API limit? SOAP (https://www.salesforce.com/developer/docs/api/Content/sforce_api_calls_list.htm) and REST API calls (which include Bulk API calls) are counted against an organization API call limit.
Indeed, we have a few external apps that perform SOAP or REST calls to our Salesforce org, such as an ERP and Pardot. These use special user names and are easily identifiable in the report.
What we are also seeing is that API calls are being made on account of ordinary Salesforce users. They range from dozens to hundreds a day. In the report they are shown with an empty client-id. We (the sysadmins) have been mimicking the users' actions, such as creating opportunities and quotes, creating PDFs, etc. but we cannot determine which user actions cause API calls.
The Salesforce documentation does not seem to be complete, apparently other actions are capable of causing API calls. Which ones?
I tried looking at the Salesforce Event logs, but there are only event logs for Login and Logout events. For the other events, you must pay extra to Salesforce.