How Can I Log Crontab File Writes
Open terminal and run this:

sudo fs_usage | grep cron


I'd run it using tmux or screen so that you can detach and check later. Depending on how many cron jobs you have, this could generate a lot of messages and you'll want to not run it where a runaway process could cause harm. (backup, check filesystems for space, etc...)

You can also use mdfind to see if you can locate the file/script/package that is calling crontab (perhaps) and correlate that with the times when the actual filesystem changes are happening.

mdfind crontab