Even if you can be sure that the event originated from a real user action, that doesn't tell you that the user did the action with the intention of taking a screenshot. For example, they could have been "clickjacked" into clicking the screenshot button.