What can be the reason for this?
The "new user" metric indicates the count of individuals visiting your website for the very first time. In contrast, "total users" encompasses both new and returning visitors. It's possible to have more new users than total users because Google Analytics categorizes visitors as "new" when the clock strikes midnight. This approach is primarily employed to maintain the accuracy of session counts. Consequently, interactions occurring during the night are registered as new, even though the client ID remains constant.
Also checkout this link - Google Support Article
Hope this helps!
It can also be because -
1. Considering the significant disparity, it raises suspicion that an automated bot or script might be accessing your website, generating single page views devoid of any user engagement.
"first_visit" is categorized as an Automatically Collected Event, and it is typically expected that only Google Analytics generates this Event. However, in reality, this Event can be generated and transmitted to GA by anyone at any given time. Consequently, the New Users Metric can be easily artificially inflated, either inadvertently by sending the "first_visit" Event yourself or intentionally by malicious parties seeking to manipulate your data.