How to identify the app/process which re-mounts partitions R/W, creates files and changes file permissions?

I have a rooted device, with superuser rights granted to a few apps I trust. I have often found my /system or /vendor partition mounted read/write, and some files chmoded to 0777. Similarly directories/files with random names are created/deleted (e.g. /sdcard/.a03Degpoif), .nomedia files are created inside them to hide their contents from gallery etc. logcat/dmesg contains no traces of all this happening in background. This doesn't happen periodically but in a slapdash way, internet connectivity isn't a condition either. I have tried disabling/uninstalling apps, looking for any suspicious processes running, but couldn't identify the culprit(s). Is there a way to figure out who is doing this?