Hi Kawtar,
Maybe one of these two timers Users module are active in your environment?
The GrantAllRolesToAdmin normally only runs on Publish, but if systems components are republished this would run too then.
The SynchronizeDomainUsers timer I don't know much about, but it might be that it contains some logic to mapp roles to users?
