A transaction log grows unexpectedly
You are just not catching it at the right times, there are lots of operations that will use the transaction log.


When do you do maintenance if any (defragment indexes, CHECKDB, etc.)?  These all use the transaction log.
Do you have any jobs that load/modify data at night?  These operations can use the transaction log as well.


As Jon Siegel suggested, use the disk usage report to get the times when it's filling up and correlate that with other activity.