Just anecdotally, I've had issues with the date I expected in the last_activity_at field when using the API, to the point I stopped using it. However it's been a couple of years, so that may have been resolved.
However, to diagnose your problem, I would first check to see if the api results match your cd2 results. If you've used the api before, use your favorite method. For anyone reading this that is in a situation where they have admin rights and access to cd2 data, but hasn't used the API, I'll offer one way that doesn't require messing with API keys.
- Open up chrome
- Log into Cavnas.
- Go to the user's course page (https://<your_institution>.instructure.com/courses/<course_id>/users/<user_id>
- Open the chrome developer console (ctrl+ shift + i).
- Run this script
let courseId = ENV.COURSE_ID; // if ENV doesn't have it, manually enter
let userId = ENV.USER_ID; // if ENV doesn't have it, manually enter
let enr = await $.get(`/api/v1/courses/${courseId}/enrollments?user_id=${userId}&state[]=active&state[]=invited&state[]=deleted&state[]=completed&state[]=inactive`);
console.log(enr);
spot check if the field last_activity_at matches what you see in cd2.