Find out which process is writing into a specific directory
Solution 1:
Use kernel audit subsystem
auditctl -w /some/dir/ -p war -k whatsgoingon
That sets up a hook waiting for something happening under /some/dir/.
Then make sure you have auditd daemon running. After that just wait until files appear and see from /var/log/auditd.log or wherever it in your system writes and read what happened and by what process.
Solution 2:
Try lsof +r2 | grep '/some/dir'. This will show processes accessing /some/dir and refresh every 2 seconds.