@evb Hello. I am the maker of the Canique MK2 boards. I started just like you with the website from Andreas Rohner, desoldering the LED and desoldering the voltage regulator from such a chinese board until I realized this is the wrong way round.
As far as I recall, I've seen voltage regulators consume something in the order of 100uA when reverse powered. So that might be a hint.
The external crystal should not be drawing that much current. Using a 16MHz oscillator current can go as low as 4uA with watchdog enabled - in theory and on boards built with minimum consumption as a design goal.
To your question regarding the SCK pin: yes, if it is connected to a LED every clock pulse on the SCK pin (when SPI is enabled) will make the LED draw current.
You also have these kinds of troubles (SPI drawing too much current when active or inactive) with chinese boards having a BME280 on them for example. If you have high quality standards, the stock chinese boards won't fit your needs.