Many libraries which manage connections for you will execute some housekeeping queries on the new connection before returning it to the caller.
SET bytea_output='escape' is just the type of housekeeping query you might expect to see.
So the likely explanation is that someone keeps asking for a new connections, and then immediately forgets about it without either using it or closing it. To figure out who, you should be looking at other fields of "pg_stat_activity", like usename, application_name, and client_addr.
And ultimately if you don't know who is connecting to your database, you should be changing the passwords or other authentication methods.