I get an alert indicating that my son has attempted to access facebook when he's not even on the computer. It only does this with facebook and doesn't do it with my daughter's log-in.
I am positive he's not on the computer when I get those messages.
Did you have the PC or a browser on during the time your son was not using it? One possibility is some software are installed on the PC and they keep checking back with it's servers. Norton Safety Minder just records these activities as it should. I have worked with a user with similar issue (not facebook though) and he found out there is an application installed on the desktop and the application contacts with its servers periodically.
Norton Online Family logs the URLs of the websites that are accessed or blocked (in this case, the URLs that the application tries to access) at Activity -> Web online.
Norton Online Family is a product of Norton. We have dedicated teams working on different updates of the program, like for Windows, Mac and Android..etc..