Are you sure you don't have some script/part of your host install infra that is messing with the permissions?
This has been seen twice before that I am aware of, and both times it was permissions related (once chmod once selinux) ... the fact that it happens intermittently would make me wonder if it's a race condition with some other script that runs?