Multiple files and folders deleted because they were tagged by the system with no reason

Today I’ve noticed that a couple of files and folders just vanished out of one of my NC installations. Thanks to the recycle bin in NC I could restore all the content. After that I started investigating how this could happen.

I have a folder “temporary” directly in the files root. This folder is tagged with an invisible tag “temp-parent”. A workflow tags all files which are uploaded or changed unter this folder (condition: If a tag “temp-parent” is present) with the tag “30 days”.
Retention then deletes all files with this tag which are older than 30 days.

In the activity I found that all deleted files were tagged 10 days ago by something: Tag “30 days” added by the system.

None of these files and folders was below “temporary” and no other folder has the “temp-parent” tag which lets the system create the “30 days” tag. None of the files or folders have been moved or touched on this day.

How can if happen that “the system” suddenly tags random files and folders with a tag (which in my case led to deletion of all these by retention)?