Okay. Just for giggles, does it make any difference if you remove row owners from the users table?
At the very least, that would help rule out any possibility that row owners are involved.
The reason we often focus on row owners is that (whilst they are the best option for securing private data) they often come with unexpected/unintended side effects.
Other than that, I don’t really have any ideas. It could be a bug, as you suggest.
Not at all, and nothing to apologise for 
Just as a side note, I’ve used the same technique that you’re using (roll up max and add 1 to get the next ID), although in my case I did the calculations in the table that contained the data being operated on rather than my users table. One thing that I’m aware of is this technique is potentially subject to a race condition that could lead to rows with duplicated ID’s. I’ve not seen it happen, but I think it’s possible - if you have multiple users adding rows simultaneously. Read more about that below…