Setup Audit Trail Shows Unexpected Changes by System Administrator in Salesforce

When Salesforce performs backend updates such as patch releases or version upgrades, the system cannot identify a specific initiating user. In these cases, Salesforce selects a random Administrator — defined as any user with the "Modify All Data" permission — and logs the change under that user's name. This is expected platform behavior and does not indicate a security concern for your organization's data or metadata.
There are multiple ways for organization preferences to be updated outside of the Salesforce user interface, including patch releases and version upgrades. When preferences are changed on the back end, the system cannot determine an initiating user and therefore selects a random Administrator to associate with the logged change.

While the example above is specific to the enablement of Consent Management, this auditing behavior is not limited to any specific feature or system permission. In most cases, there is no security concern regarding your organization's data or metadata.


 See also: Records Created, Updated or Deleted Unexpectedly