unknown compute instances we are getting billing

Is it possible for us to see the details of your invoice? (Please mask account ID, etc.)

It is possible to find active services by way of the following documents.
Please check once for reference.
https://repost.aws/knowledge-center/check-for-active-resources

Also, if you know for sure that r5.large is occurring on EC2, you can identify which region EC2 is running from the EC2 global view.
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html#global-view

1. Go to Cost Explorer -> Choose Date Range in right pane
2. Granularity -> Daily
3. Dimension -> Usage Type
4. Service -> EC2

Note: Repeat same by changing option in Dimensions field as Cost Category and Availability zone, Charge Type one by one and see where you see charges are coming from. If you can view bills, that would have these details already, if you have already been charged.

This would show you when and what are the resources/which AZ that's happening.

If you want to check not only for EC2 but for others as well, don't select anything in Service field.

If you want to setup alert, you can consider setting up AWS budgets and configure alarm on those, which would notify you, if you cross the defined usage threshold. Follow the Well Architected Lab instructions here for setting up budget alert based on your usage.

However, if you still don't figure out and think that it's not a legitimate charge, contact AWS Billing Support Team by following instructions at here