You are measuring two 6-second windows and a 4-second window, of course the amount of attacks will differ. By the collection of data, it looks like auto-attack is once every 2 seconds, not 3-4, so it's perfectly reasonable.