It could be many things, plugin, workflow, flow, Dataflow, something integrated.
Rather than going straight to Security Roles, look at what user(s) are in the Created By field of the records table.
Check if it always the same user,
if they are created in batches (batches e.g. lots of records with their Created On in the same minute)
Turn on the plugin trace log, then remove security role privileges, if it is plugin or workflow you will get errors entry in the plugin trace log or process sessions tables - that will tell you what is doing it. If its Flow you won't get an entry in those tables, but will then have to look at the Flow runs for failures.
(the extra issue if it is Flow outside of a solution or a Dataflow, is they can be hidden from your user if you are not the owner of them)