HI ,
Are you using any management tools on your environment .
This issue typically comes if any third party monitoring software that is unable to login and locks out the root user.
Use any monitoring tools slike Orion SolarWinds or TCPDump to identify product/source which is causing the issue.