Detecting "ghost" switching

One of my smart lights occasionally switches on for no apparent reason. I understand this phenomenon is known as “ghost switching” and is likely caused by stray RF (in my case anyway - a Sonoff D1 dimmer). I stripped out the resistors in a couple of D1s, but maybe I missed this one. I’ll have to strip it out and investigate sometime, and maybe replace with somehting else. In the meantime, I’d like to just detect the ghost switching and immediately turn it off again. Problem is, I don’t know how to positively identify. As it happens spontaneously and fairly infrequently, with no way to trigger it, it’s not easy to characterise.

Depending on how the lights are normally activated (UI, another Automation, voice command via Google Home etc.) I can see various combinations of trigger.to_state.context (id, parent_id, user_id). Does anyone happen to know if there’s likely to be a pattern that would only occur as a result of such ghosting?