Rate limits are per user/IP. Also, they are hardcoded by Mastodon. There are no extra rate limits implemented by Masto.host. So, they are only triggered by the actions of the user/IP, things like mass deletions, scrolling lots of pages very fast, etc.
They can happen when a user has opened multiple tabs or even an app on their phone (not being used) that may be making background requests while the user is accessing Mastodon on another device/browser/app.
Also, if there are multiple users on the same network accessing the same server, this can trigger a rate limit.