I solved a similar mystery by running a profiler trace to find where it was coming from. It was an SSIS package on another server.