Webservice user ids are locked

I wonder if anyone can shed some light on why this might be happening. 

On one of our instances we have 2 web service access only users. One is used for MID server access, the other for REST API access to update a table.

Both these accounts work fine when the user is not locked, however it seems that some process that runs every day at about the same time, locks these users. That causes the MID servers to stop working and REST API access to the table that needs updating no longer works either. 

Just a short while ago, both users were locked again at 23:59:00 GMT by user "admin". Which leads me to believe there is some process, a flow or background script that is running daily that locks these users.
There are no invalid login attempts recorded. In the node logs there are no obvious clues, other than 23 seconds later the MID server is no longer working. The "Lockout events" table is empty.

Would anyone know if such a process or what would cause these users to be locked, or how to find out what locks these users?

Thanks

Ron