When do processes run under root by default?

Solution 1:

The setuid bit could be set on an executable.

When the setuid or setgid attributes are set on an executable file, then any users able to execute the file will automatically execute the file with the privileges of the file's owner (commonly root)

https://en.wikipedia.org/wiki/Setuid

If setuid is applied and the binary is owned by root (and on macOS the entire directory hierarchy to that file is also owned by root), then the binary executes as root regardless of the current user.

You can find all setuid & root binaries using

find /path/to/search -user root -perm -4000