Way to check where the MySQL connection was initialized?
Who has the root password?  If there are multiple admins with root permissions, change them to non "root" user names, but with ALL PRIVILEGES.  Then you can distinguish them in the general log.

"Socket" implies the same machine; nothing provides what program.

I recommend you add comments to every query, perhaps with the filename and line number (__LINE__).