The service triggering the CRIT isn’t check_mk@… but user@0.
I suggest filtering out user@\d+ instead of check_mk@.
Btw, your regex isn’t what you think it is (but matches anyway). check_mk@* means check_mk followed by an arbitrary number of @ characters (including none). It matches check_mk and check_mk@@@@@@hello and check_mkhello. Since the regexes match at the beginning you can simply write check_mk@ (or check_mk@.*).