Depending on the EC2 instance type and the underlying hardware, you may not be paying for access to all of the underlying CPU cycles. Amazon is not going to give you access to 100% of a modern, fast CPU if you have asked for an m1.small which is promised to be equivalent to an old, slow CPU.
On EC2, steal doesn't depend on the activity of other virtual machine neighbors. It is simply a matter of EC2 making sure you are not getting more CPU cycles than you are paying for.
If your m1.small gets 50% of the underlying faster CPU, then for every bit of CPU you are using, you will see another equal percentage flagged as steal.
It would be nice if EC2 let you think your true available CPU was "100%" instead of teasing you with the rest of the CPU that you don't have access to, and then telling you that you can't have it when you try to use the CPU, but that's the way it works given the current VM and host setup.
m1.small instances are likely to show a high percentage of steal given the limited CPU they have access to for the price compared to the CPU speeds on the underlying hardware.
If you are concerned that this particular instance might have something broken on EC2's side, you could stop/start it to move it to new hardware (my article on this) and see if that makes a difference. Of course, if the steal percentages drops, it might just indicate that you have moved to a slower hardware CPU.
As to the activity every 30 minutes, that is software on your server. It could be a system cron job or it could be triggered by a daemon (background process).