How can I figure out what program is starting and quitting?
Well the obvious solution is to temporarily disable SIP and run execsnoop as you’ve yourself identified.
There is a cruder and less reliable way which doesn’t require SIP disabled. The next time you see this happen, quickly go into Terminal and run
$ log show —-last 1m —-info —-debug —-predicate='sender contains &quot;launchservicesd&quot;' 

That will show you the last 1 minute of breadcrumbs from Launch Services, through which it is likely that your mystery process is being invoked. If it’s not, you won’t see it there. Look for (and/or grep) lines containing CHECKIN and DEATH.