How to detect which module creates session?
Unless you have a strong suspicion on a particular module or a small number of modules that could be creating a session, finding the 'culprit' module could be too tiresome. 

I would suggest searching for the 'cookie name' instead of a string like '_SESSION' as a more accurate and a faster way.

Say if the cookie name is 'PLAY_ACTIVE_ACCOUNT' (real example from site play.google.com), you could navigate to the parent directory of your contrib module and do a grep -iRn PLAY_ACTIVE_ACCOUNT * to find the filename and line number of where this session cookie is being set. And then disable the module or take other action.

You can discover the name of your cookie by using your browser. In chrome you could do this by typing chrome://settings/content in a new tab and then clicking on the button 'All cookies and site data'. And then typing in the name of your site domain (like I have used play.google.com for example)