The single most important clue is 3:17.
That's not a time a human picks (3:00, 3:15, 3:30) are human-scheduled crons. 3:17 screams "something with a randomized offset"
Before I touch anything, I'd let it happen one more night with a profiler armed and a packet capture running.
If the stack trace points into our code, we have a scheduled job we don't know about.
If it points into the JVM/runtime or kernel, it's GC, JIT, or system-level.
If it points into a library, it's probably a background thread someone added in a transitive dep.
The answer is in the stacktrace