Tripwire reports files change time different

[greyfeld]

We are using Tripwire for servers on SecurePlatform. Tripwire is reporting every few days that all of the files in directories like /bin, /sbin, and others have a new change time. File sizes and hashes are all still the same. It looks like all of the primary OS files are being "touched" at the same time, as if some process is running to check and verify the files, but I can't figure out what it is.

It is not Tripwire, because the change time does not coincide with when we run our integrity check. The change time also does not correspond to any of our cron jobs. It also always seems to happen between 1 and 3 a.m. when no one should be accessing the SPLAT servers. Does anyone have any ideas? Thanks.