Home Alarm changed to Arming by Hass.io

Since a few days my alarm randomly goes to the triggered state. When checking the logbook it says “Home Alarm changed to Arming by Hass.io”, anyone have any clue to where this might come from?
I’ve tried enabling debug logging on homeassistant.components.alarm_control_panel, but nothing pops up in the logs unfortunately.

In my case this was a Hypervisor “service” user which in the end was a Nodered flow that was still active but with old settings.