That query comes most probably from a reference qualifier field (like Caller in incident). Due to the OR conditions in the query the index on "active" field is the best one currently. But, the 0,250 suggests me that you have a list view of 250 rows and that is probably causing the issue. Why not set it back to 20 or max 50 ?
Your query has to scan sys_user table through all active users (most of sys_user records are usually for active users, but the limit on 250 causes the sort overhead).
Each query contains the session id of the user that triggered it , like for example "gs:B767A27FD5C8C300E485B253E62BDD74", if you go in the UI System Logs -> Transactions (all user) -> Personalize the list view to include 'Session' field you can use a filter on "Session is B767A27FD5C8C300E485B253E62BDD74" and this should show you what the user was doing at that time. This will allow you further to identify the reference field that causes this query, so you can take action on the limitation of list rowcount.
