We have a Donald too!
I am dubious about the WorkSpaceId and WorkSpaceName columns myself. When I look at the entire history of our audit log (Since around mid-Feb 2018) data, the Workspace column data doesn't always parse with what I know to be true, and it isn't always consistent. Here are a few cases:
1: A user has a hit with "My Workspace", and it is correct. Something they were working on in their workspace.
2: A user hits a known report published in an App (as an aside: is it the Workspace being logged there, or the app? Is the app usage logged anywhere?) and it is correct.
3: A user has a hit with "My Workspace" in both the ID and the Name column, and it is incorrect. I know where the report they're using is published and there is no way it is in their personal workspace. There are a lot of these.
4: A user has a hit with My Workspace in the ID and their first name in the Name column, so we have a bunch of workspaces with first names. By the by, sometimes other peoples' names show up as viewing a report in this My Workspace, so I'm not even sure it's true. And the case in #3 and #4 is happening simultaneously; we have first name workspaces and My workspaces being logged interspersed.
5: A user has a hit with My Workspace in ID and Donald in the Name column. This was a weird series that seems to have mostly abated now but did plague us in October it seems.
Either way, I can't trust the data in either of those Workspace columns at all. I don't know how to parse the historical data to scrub for those things because it is inconsistently logged incorrectly.
@Stefan74 do you have a person named Torsten in your org? Per my #4 above that's how we wound up with a bunch of workspaces with first names. Doesn't explain why we had so many Donalds, though, because all sorts of people were showing up in there.
