Is it possible to identify what the parent program/app is from a running process?

I'm able to find processes using top or ps. That's no problem.

Sometimes I find that some processes are taking up a lot of memory or cpu and I'm trying to identify what the root program is.

For instance, the process sort sometimes just ends up taking 2-3 gigs of memory over like 4 hours. I'd like to know what program initiated the sort process so I can try and fix it.

ps has an option to access the PPID/parent PID of a process:

$ ps aux -o ppid
USER               PID  %CPU %MEM      VSZ    RSS   TT  STAT STARTED      TIME COMMAND           PPID
admin            65694  10.9  0.1  4385132  13340   ??  UN    9:32PM   0:00.07 /System/Library/     1

PPID is the last column in this case.

(Or use Activity Monitor by selecting View -> All Processes, Hierarchically)

You can use htop and show "tree" precesses (by pressing F5) there. Here's an example: