It could be StorageCraft ShadowProtect or a third-party that uses the same engine, like Datto. Either one would have central management that would dictate the backup schedule and collect logs, although you should at least see service and VSS SQL Writer activity in the local System and Application logs (which prove a backup event has occurred). The easiest thing to try would be to disable the StorageCraft services (Raw Agent, ImageReady and Shadow Copy Protection) right around that time.