Do you know when the change appears to be happening? Is it during a Scan or Update, or when ldagentsetting runs on the client? This will help narrow it down.
The change appears random. However, I've seen it on my system when working off the corporate network.