System call are those things documented in section 2 of the manual. They are things like open(), read(), fork(), exec(). Each time any program calls any of those, a counter is incremented. vmstat is showing the increments to that counter.

Once a process starts to run, it gets to run until its timeslice runs out. But if it does something like read(), it must wait until the read finishes before it can run some more. When one process stops running for any reason, the kernel must look at the run queues to find another process to run. This operation of allowing another process to run is called a context switch. Again each time it happens, a counter is incremented and vmstat is showing the increments.

If no process is on the run queues, the kernel will repeatedly scan the run queues until a process appears there. While the kernel is scanning the run queues, the system is idle.

A high number of context switches is not good. If the kernel is context switching too often, that 10% idle could be misleading. It might actually be scanning the run queues once 10% of the time rather than looping as it waits for a runnable process.