Audit records show updates to records, for example Incident records, by an inactive user who has not logged in a long time. In some cases, these Incident records show a pattern of being updated at around the same time of the day in several occasions
The cause may be an entry made in the sysauto table or sysauto_script table, also known as a Scheduled Job. This entry was created by or updated by the same user indicated in the Audit record of Incident.
To stop these automated updates, deactivate the associated sysauto or sysauto_script records.