

Tripwire and auditd can monitor a filesystem and notify you about changes. I don’t know the tools myself, because i never needed them. Maybe these can give you a hint on the responsible service.
If you suspect a certain service to be responsible: what do the logs of the service say? If nothing: increase the loglevel to info or debug?
Sorry. No solution. Just ideas. Good luck.
I did. Twice. I regret nothing.