If you have a connector configured to look for syslog data in a particular facility, and matching logs from a new node appear in that facility, the node will automatically be added to LEM. e.g. You've configured the Cisco IOS connector to monitor local2.log for IOS logs. If a number of Cisco IOS devices start transmitting logs to local2.log, that one connector will parse all those logs and each node will consume a license.
The only way to prevent these new nodes from being added to LEM is to disable logging to LEM on the source device.