Yes i have , thanks for the reply.
It happens when the daily cwp cron runs i can run it manually and it'll just dump stuff into root ( the cron runs as root) the funny thing is if i enable modsec it doesn't happen so im guessing something is not being removed when i remove modsec, but still poking around a bit to figure out what.