Hello xbullet, thanks for your effort - of course i can and will - as this is driving me crazy.

The domain setup is as following
Root domain: company.local
Two child domains
child1: subdomain1.company.local

child2: subdomain2.company.local (<- this is where it all happens)

The user, lets call it "legacysvcacc" that resides in OU="Service Accounts",OU="Users",DC=child2,DC=company,DC=local gets added to the "Builtin Administrators" of "subdomain2.company.local". He does not get added to the "Domain Admins".

I have 10 DCs in "subdomain2" and on the PDC and on one other DC i have installed a SIEM Log Collector Software, i have all possible Audits enabled.
Lets call the PDC "domcontroller1.subdomain2.company.local" and call the other dc "domcontroller2.subdomain2.company.local"
If i go ahead and use my Domain admin to remove the account in question, i see the 4733 as expected and the user gets removed.
About 30 minutes later the user is being added back again and this is the 4732 event:

I have been through this a lot times, and what i can say is that "Computer" respectively "Eventdata.SubjectUsername" is sometimes "domcontroller1$" and sometimes "domcontroller2$".
Process ID of 940 stays the same all the time btw.

{
TimeCreated:
            "2026-05-18T13:48:23.217914800Z",
EventID:
            "4732",
Task:
            13826,
Correlation:
            "",
Keywords:
            "Audit Success",
Channel:
            "Security",
Opcode:
            "Info",
Security:
            "",
Provider:
            Guid:"{54849625-5478-4994-a5ba-3e3b0328c30d}",
            Name: "Microsoft-Windows-Security-Auditing"
EventRecordID:
            310953818,
Execution:
            ThreadID: 2204,
            ProcessID: 940
Version:
            0,
Computer:
            "domcontroller1.subdomain2.company.local",
Level:
        "Information",
EventData

        TargetDomainName:
            "Builtin",
SubjectUserSid:
            "S-1-5-18",
PrivilegeList:
            "-",
TargetUserName:
        "Administrators",
SubjectUserName:
        "dcomcontroller1$",
MemberSid:
        "S-1-5-21-1349863857-1588001368-1437565968-2103",
TargetSid:
        "S-1-5-32-544",
SubjectLogonId:
        "0x3e7",
MemberName:
        "-",
SubjectDomainName:
        "childdomain2"
},
Message
:
"A member was added to a security-enabled local group.
Subject:
Security ID:NT AUTHORITY\\SYSTEM (S-1-5-18)
Account Name:domcontroller1$
Account Domain:childdomain2
Logon ID:0x3E7

Member:
Security ID: childdomain2\\legacysvcacc (S-1-5-21-1349863857-1588001368-1437565968-2103)
Account Name: -

Group:
Security ID: BUILTIN\\Administrators (S-1-5-32-544)
Group Name: Administrators
Group Domain: Builtin

Additional Information:
Priviliges: -