dsync replication

We have a setup with ldap and sql passdbs and sql userdb, from my understanding of the documentation dsync repliction picks up the users to replicate via the iterate query. This query returns 646 users in sql (not everyone gets replicated) but when i run a doveadm replicator status

Total number of known users 92236

seriously that kinda lot more than 646

Does iterate_query belong in user_db or passdb? Is it the fact I have ldap and sql passdb and its picking up dome default ldap query as well the specified sql iterate query ?

rgds

Matt