I support two WP sites for clients. I’ve had these “bursts” of 30-40 subscribers signing up. They don’t seem to do anything, just sign up. I’ve set their permissions to read-only, so they can’t do anything (that I know of).
What are they hoping to get from this? They need links there to game the rankings don’t they?
I assume that if you get that number of accounts out of the blue, there’s a chance that these accounts are created by spam robots (some scripts can easily pass a captcha and recaptcha). But even if they’re real users, they may wait till the have the chace to post a comment (probably something like “I like it” or similar) and add their link to get a back link to whatever site.
But you already guessed this so you’ve been smart enough to forbid them to do anyting but reading 