Unknown users and group files found by rkhunter. Is this suspicious?

Most likely, those are system/service accounts created upon installation of both services.

See Arch Wiki on User and Group Management under “Example Adding a System User”

Looks like a separate issue to me, probably not related to Manjaro. You may want to open a separate thread for that.