We have a multi-node live system, where we are seeing alerts that we believe are caused by a PRPC agent, but the information we have makes it hard to know what is going on

Firstly work objects are being opened by users on one node (SAS01)

SAS01

2016-11-07 07:46:31,294 [   WebContainer : 25] [TABTHREAD4] [ ] [   SJapan:01.05.01] (gerStatement._baseclass.Action) INFO g.net SBA02292 - **AGC Logger**  | SBA02292 | SG200000039040012662 | ImpersonateTriggeredby : System | 20161107T074631.293 JST | Alerts | View | WORK-TASK TASK-1931089 |  |

2016-11-07 07:48:24,616 [   WebContainer : 32] [TABTHREAD5] [ ] [   SJapan:01.05.01] (gerStatement._baseclass.Action) INFO g.net SBA02292 - **AGC Logger**  | SBA02292 | SG200000039040012662 | ImpersonateTriggeredby : System | 20161107T074824.616 JST | Schedule Memo | Update | Task-1931089 |  |

Then very shortly afterwards  Pega activities running on other nodes are attempting to do something - see more information below these alerts

SAS03

016-11-07 07:46:37,601 [.PRPCWorkManager : 2] [  STANDARD] [ ] [   SJapan:01.05.01] (         WorkLock.Work_.Action) ERROR   - Error in Obj-Open-By-Handle

com.pega.pegarules.pub.database.AuthorizationException: You are not authorized to open instance WORK-TASK TASK-1931089

From: (BA5E1FD122C6322298A80577152916300)

SAS06

016-11-07 07:48:30,346 [.PRPCWorkManager : 1] [  STANDARD] [ ] [   SJapan:01.05.01] (         WorkLock.Work_.Action) ERROR   - Error in Obj-Open-By-Handle

com.pega.pegarules.pub.database.AuthorizationException: You are not authorized to open instance WORK-TASK TASK-1931089

From: (B5F209A1E5DDFBBBD9ABB4E96902CCC6E)

• The system handles 20,000 users per day, spread across 8 nodes, so 2,500 users per node per day
• This issue only shows up radomly, between 15 and 30 times per node per day, and the time of day is random
• The issue only started showing up after implementing Object-Level Security (OLS), such that only specific users have access to each work object
• System is not a recognized user
• Prior to OLS these errors did not appear in the logs
• The logs show no stack trace or any other indication of exactly what might be running and trying to open a user work object, but BA5E1FD122C6322298A80577152916300 indicates a background agent.  The only agents running on these nodes at that time of day are Pega agents

Can anyone help shed any light on this?  I know that this is ridiculously little information to go on, but if anyone can suggest other places/logs that can help pin down the issue then we would really appreciate it.