I recently noticed (by doing top) that there is a process running tor by the user debian-tor. I have installed tor, and use it frequently along with torsocks, but I didn't expect to see it running without my calling it first, and for a while it either wasn't happening or I didn't see it. Is this normal behavior, or is there something off?
It seems you have installed the Tor package, either from Tor directly or as a Debian package. By default the software is set up to start by system start and it always runs in the background. So this is expected behaviour.
You can disable this with systemd or with startup scripts.
update-rc.d tor disableor set
/etc/defaults/tor. However note that commands like
torsockswon't start tor and expect a tor daemon to be running already.