How did you set the keypool? The increase to 10000 might have been caused by the way that you had set the keypool size.
Did you get a new address 17 times? It looks like Bitcoin Core is trying to keep 10000 address in the keypool, so if you request a new address, it will generate another and add it to the keypool. This will happen even if you don't have any transactions.
I set the keypool size in the .conf via -keypool=5000. After wallet encryption, I noticed that in the debug.log it said it loaded 10000 keys, all encrypted.
Yes, I manually created addresses via 'getnewaddress'. I tested it just now by manually making a new one, but the keys after a restart were still 10017. But it might be that though.
How the 5000 turned into 10000 is still a mystery.