Large traffic on a new gateway

I am new to TTN. I bought one gateway (Dragino LPS8) and connected it to TTN just a week ago.
Today, I have checked the traffic log and see that there is already a lot of traffic - but it all comes from 3 devices, belonging to the same app - and they come every 5 seconds (in a sequence, so each device sends every 15 seconds) and each has an airtime 1482.8 ms (and length of 23 bytes).
If I read this correctly, then each of this devices would have a duty cycle of 1482.8 / 15000 = 9.9% and airtime of 8540 s/day - which would be a clear breach of the European regulation and the TTN policy.
In addition, I guess it uses a big chunk of the gateways bandwidth.

My question is whether this is normal and if not, what can/should I do about it?

When I click all the messages in the log, they are all marked as “Join request”.

That stands to reason as only with join requests you’ll see app information, the AppEUI to be precise.
What is the AppEUI you are seeing?

And the owner is probably not aware of the issue. What are the RSSI and SNR values? (Given your information the nodes must be using SF12)

It uses 1/8th of the gateways incoming capacity (one of eight demodulators) So big is relative, you still have 7/8th left.

Thanks for answers.

Here are selected event data (and you were right, it is using SF12):

{
  "lora": {
    "spreading_factor": 12,
    "bandwidth": 125,
    "air_time": 1482752000
  },
  "coding_rate": "4/5",
  "rssi": -120,
  "snr": -4.8,
  "app_eui": "70B3D57ED002F5A2",
  "frequency": 868100000
}