w does not deal with tty devices directly – it only displays those registered in
/run/utmp. Programs (such as terminal emulators, or remote login daemons) usually register themselves to become visible in the
who list, but are not required in any way to do so.
For example, the
screen utility deregisters itself when you detach, despite keeping the pty devices allocated. A popular replacement of screen,
tmux, never uses utmp – it isn't programmed to use it. Some terminal emulators do not register themselves simply due to lack of privileges (the program needs to have "setgid utmp" set). There could be more reasons, and not all of them malicious.
fuser to see all processes having those ptys open:
sudo fuser -v /dev/pts/*
sudo lsof /dev/pts/*