There is no "default read access" for any group. At one point you have explicitly configured this, maybe by using one of the pre-existing groups shipped with CQ ootb. THe useradmin should give you insight, from what group a certain permission comes from.
Jörg