When you have self-referrals, a technical bug happens where a new session is recorded by a new user. The traffic source for the session is set as a referral from your own website.
When this happens, and you also have the referral exclusion list setup to disallow referrals from your site’s domain, Google Analytics defaults to the last known traffic source. Since there is no known traffic source for the new user and session, it defaults the traffic to coming from “Direct”.
To solve this, you must remove the referral exclusion list and get started on fixing your cross domain tracking problem.