Okay we had a similar item happen to us and we used OSquery to track it down (Via Symptoms)

trying to clarify -- did osquery also exhibit this problem? If so, we should open an issue to keep track

No, it was another Sysext , not OSquery which had this issue. In this case it was antivirus.

gotcha, thanks!

'Via Symptoms' - is that a tool or process or something?