SELECT user_id, COUNT(*) AS errors
FROM logs
WHERE level = 'ERROR'
  AND ts >= NOW() - INTERVAL '3 DAY'
GROUP BY user_id
HAVING COUNT(*) > (
  SELECT AVG(cnt)
  FROM (
    SELECT user_id, COUNT(*) AS cnt
    FROM logs
    WHERE level = 'ERROR'
    GROUP BY user_id
  ) t
);