So I am using pamac and the AUR to keep a few packages installed and up to date. These are mainly commercial packages such as VS Code, Spotify, Postman, LibreWolf, etc. I have a short list of about 10 packages that I use. My question is that it always seems to be that extra AUR software packages slowly add themselves to the list little by little every update. This last round it was “bridge-utils” and “openssl-1.1” both from the AUR, previously it was other seemingly random packages. I have not manually added these packages from the AUR so I am just wondering where these come from and why they get installed? A lot of them require me to accept a whole bunch of PGP keys and I’m just not willing to do that for anything but the packages that I’ve specified to install and update. I’ve had Manjaro installed for about 4 years now, so there may be a lot of cruft around the system, but it has been completely stable.
Those packages are dropped to aur from the repos if they are not regularly maintained. That is exactly why one have to clean the orphans and the foreign leftovers after the monthly update.
After some time those will begin to cause trouble.
So clean everything you didn’t install yourself (or got installed as dependency).
From the last major update couple of days ago, openssl1.1 is one such leftover that has to go. There is another much newer version in the repo.
P.s. while orphans are always safe to remove, apply critical thinking with stuff dropped to aur. The update before the last dropped the 2 gesture packas to aur, and since i use gestures i kept those.
Possibly dependencies for packages you’ve already got from AUR?
You can see the installation reason in pamac-manager (or using the various command-line tools).
Most commonly, these would be packages (or no longer required dependencies of older packages) that were dropped from the repositories onto the AUR. You should uninstall them — especially something like openssl-1.1, which is no longer secure — unless of course you really need them.
I also recommend checking whether you’ve got orphaned packages. 
pacman -Qdtq
In order to remove those…
sudo pacman -Rns $(pacman -Qdtq)
One thing to keep in mind is that some “orphan” packages may be build requirements for AUR packages. As far as I can make out (someone with deeper knowledge may tell me I’m wrong), these show up as orphans once the depending package has finished building. So removing these means they’ll have to be reinstalled if the package that asked for them needs rebuilding.
Unfortunately there doesn’t seem to be a way to recognise these.
@beermad is correct, and so is @Teo and @Aragorn - you must regularly do some housekeeping.
It is common knowledge that Manjaro inherits the vast majority of packages from Arch Linux.
When Arch Linux maintainers remove a package from the official repository then don’t just throw it away as there may be users that depends on the package, so as a courtesy (my guessing) towards those users the package script is added to AUR.
The native package manager (pacman) does not use the AUR.
Manjaro users on the other hand uses Pamac GUI for everything, including AUR. This will lead to rebuilding package scripts for packages once in the repository, but moved to AUR.
This fact has lead to topics, intended to help users understand their system, leading to a better update experience.
Keeping several kernel packages, their matching headers and orphan packages (no longer required by other packages, or deprecated (moved to AUR)) lead to extensive downloads and possible dependency hell.