Hi Saranesh

I had already checked flows but nothing stood out.  As per your suggestion I checked the scheduled jobs and there is "Password Update Reminders to Service Account Owners" that starts at the time these users were locked.  Checking the script, indeed this one sets the user to locked if there are 0 days left to change the Service Account password. 
In the Events table it creates an item "password.reset.notification" so I was able to correlate these 2 userids to this scheduled job. 

Thank you!
Ron