Thanks. Found out from unix admin that some of the 'jobs' are using cfengine (which i'm not familiar with). Other than those you suggested checking - anything else if using cfengine?
I keep encountering events in the BSM/C2 logs which shows that the audit-user who performed the event is the user (e.g. ongkk in the example below). However, the user is able to show me that...