Something on Ubuntu is changing File Attributes to immutable

So the issue is curious. Something or some service is changing the entire domain directory of a website (yes, only one of hundreds) to immutable attribute. Manually one would use chattr to do this, but it happens almost every second day, whereas no other human has access to this system. The server runs ubuntu 22.04, Lightspeed webserver LSWS and Cyberpanel. Has anyone experienced something similar? Is it me going crackers? Is it a ghost? Thanks guys for @potential@ answers / ideas / suggestions....