I believe some plugins that need information from event log might be the cause. The plugin author may insert settings in qa_options table, which makes event logger automatically enabled. Such plugins are often those that output user activities. You only worry if you don't have such plugins but the event logger plugin stays enabled.