growing of a thin provisioned virtual disk is usually caused by some guest OS (guest file system) actions. However, I can't unfortunately tell you what exactly is going on.
Some question though if you don't mind:
does this occur at some specific day of the week, and/or at certain time?