Most users online is stored in the datastore table. If the number is wrong, then something happened to make it wrong (a modification).
As for the rest... make sure you have all default files. Go to maintenance > diagnostics > suspect file verison and make sure they are all fine (no default file should be listed there). Then, try disabling your modifications/plugins and see if you still have this problem.
Note: To temporarily disable the plugin system, edit includes/config.php and add this line right under <?php
PHP Code:
define('DISABLE_HOOKS', true);