Could this be caused by an OTA Update? Every day that I use my iPad, there are multiple OTA Update logs generated. One is created at the time I power on and one or more are generated while I’m using the device.
I have automatic updates turned off everywhere I could find it listed in settings, e.g. OS Updates and App Store settings (let me know I missed any?), but the OTA Updates still install.
Listed below are a few lines from one of the OTA Update logs that was created on the day my security settings were reset after a restart:
{"restore_payload_version":"Unknown","restore_type":"OTAUpdate","os_version":"23B85","itunes_version":"23B85","bug_type":"183","restore_error":"78","name":"iPhoneRestore"}
1f6496200 : initializing new submission queue
1f6496200 : MSU running in normal env
1f6496200 : is_first_boot_after_update: is first boot: NO
1f6496200 : retrieve_previous_update_state: found previous update state MSUPreviousUpdateState=1
1f6496200 : is_first_boot_after_update: is first boot: NO
16f223000 : submitEventsInBackground running
16f223000 : -[UMEventRecorder _supportDirectoryWithMountPoint:]: mountPoint is nil...Using /var/MobileSoftwareUpdate as the mountPoint
16f223000 : -[UMEventRecorder submitEventsInBackground:withOptions:]_block_invoke: Previously submitted events will NOT BE resubmitted
1f6496200 : hw.osenvironment = ''
1f6496200 : Detected BootedOS environment (hw.osenvironment=<empty>)
1f6496200 : Successfully saved booted os state
16f2af000 : Client softwareupdateservicesd[290] does not have the 'com.apple.private.softwareupdated-helpers' entitlement
16f2af000 : retrieve_previous_update_state: found previous update state MSUPreviousUpdateState=1
16f223000 : event reporting is not enabled, discarding event (purge) - (null)