Tripwire and auditd can monitor a filesystem and notify you about changes. No experience with tge tools, never needed them. Maybe these can give you a hint on the responsible service.

If you suspect a certain service could be responsible: what do the logs of the service say? If nothing: increase the loglevel to info or debug?

Sorry. No solution. Just ideas. Good luck.