Anti-malware… not management/client-enforced-McAfee by any chance? 
I once dealt with client who required McAfee HIPS. It would randomly chew through system resources (it was especially fond of consuming all the swap space), sometimes it would cause kernel panics and it zeroed out random files in /usr/bin (“hey, why isn’t awk working?”). What a steaming pile of turd that software is. Unfortunately I don’t remember the exact details of the underlying problems beyond “ugh, McAfee”, but there was a bit of lsof and strace involved as well as combing through auditd logs.
Good to hear you’ve made progress though, happy hunting 