It could be that a cron program is running. Like each night the `locate` database is rebuilt, man pages are fiddled with, logs are moved (weekly), etc.
You can run:
to see what is running. It's quite unlikely (but not impossible) that you have a security problem causing it. Also, look through your logs in /var/log/*
If you're really paranoid, you can run:
This will hunt around and check for root kits.
Again, I doubt this is security related. :)