Can't remember the terminology they use but Strava allows you to define privacy areas (within a configurable radius of a point) where no points are shown on your individual routes. Exactly to stop someone working out where you live/work from browsing your history.

Either they haven't honoured this when calculating the global heatmap or, more likely (and harder to fix), such locations are given away by friends uploads (who don't have the same privacy areas defined).

Oops.