Can SP service account remove permissions

I have a number of sites and noticed one site and its libraries permissions disappeared overnight - when the system service account ran. I narrowed it down to one action - chkperm, which only showed in the affected sites/libraries.

Can someone advise if a service account can be set to remove permissions?