Users with no roles are getting onto my system
Users with no roles are how the default "Authenticated user" role is listed.  I.e. these have the access level that the system gives the role ""Authenticated user".

This by itself is nothing to be concerned about.

If you don't want to allow bots and fly-by users to create accounts, navigate to Home » Administration » Configuration » People » Account settings and under Registration and cancellation, click that only admins can create new accounts.

If you want people to able to create accounts, but not bots, you need to let the registration process tell bots and humans apart.  One of these modules may help:


CAPTCHA - See also: How to add CAPTCHA to registration
In particular; CAPTCHA Riddler 
Mother May I


However, in 2015, bots like XRumer knows how to do most CAPTCHAs including math and "warped" letters - you may need to experiment a bit to find a CAPTCHA configuration that works.

But preventing spam registrations are actually the topic of this question: Unknown User Registered into my system