user_activation_key is one of those keys that WordPress uses for authenticity of a Reset Password request.
So, when you are saying this key is empty for some users, the reason is, those users have never requested for a password reset.
When a password reset is requested a temporary key is generated called check_password_reset_key and sent via email for the reset process.
When the user goes to the generated link, this key is directly compared with user_activation_key. If both keys don’t match then it is considered to be an Invalid Request. Otherwise it proceeds and the user will be allowed to enter a new password for his account.
If you want to understand how it works with more details, you can check the wordpress documentation.