@depthless Not sure how you'd track it down but it's likely to be a scheduled script, map/reduce or mass update that's updating records which is then being logged to that/those record(s) in the system notes. I'd take a look at those.