…turns out it was a CI build (system is a Gitlab runner) running in a docker container and the execution was C code that resets the localtime for our embedded devices.
Just a word of warning for anyone working with CI/CD, docker containers will reset your host system datetime quite easily it seems.
Edit: just for some clarity (because discussions seem to be going a bit wild) this system is an isolated server running nothing but a gitlab-runner service in the Enterprise. It's sole purpose is pulling and building development artifacts. The gitlab-runner is designed to run Docker-in-Docker for building and testing Docker container development.
It's not a desktop workstation.