How are current anonymous users calculated?
Have a look at what's written in Comment nr 5 of issue nr 799262, ie:

Basically, the anonymous user count in Drupal core's &quot;who's online&quot; block counts how many sessions are stored in the database, minus the number of authenticated sessions.
If you haven't correctly configured PHP to periodically cleanup the active sessions, the table will continue to grow. I just cleaned one today with ~75,000 old anonymous sessions. This not only causes confusion in the who's online block, but also has a severe performance impact on your site if it's mildly busy.
This article shows you what you need to put in settings.php to ensure your anonymous sessions are being cleaned: https://techcommons.stanford.edu/topics/drupal/sessions-table-cleanup