you have mentioned that you login to plug-in systems. So, why would it call GRC? i think there is user exit activated for this behavior. Could you check in SSM_CUST or check with Basis.
you can check in SM21 or activate SM19 to check RFC calls, to identify the RFC user id