Determining source of ulimit change

I have a server built with AWS OpsWOrks, so everything is in configuration. There is a process whose ulimit is set to 4096, as checked from /proc/$PID/limits. This process runs as root. I ran the ulimit command as root user which shows the file limit as 1024. There are many servers (around 50) configured with the same cookbooks and all of them have the same configuration "drift". There is no knife ssh involved so couldn't have been someone running a one-liner on all instances. The codebase doesn't have a single line referencing the value if 4096, so I am stumped. Is there any way I can determine how the process might have picked up the value of 4096?