> What could be causing the routing table to spontaneously change in this > manner without my intervention?
If one can be sure that /sbin/route is invoked, you can alter this file name and make a script with this path where you can print other names or information about who is calling this. I'm not sure if there is another way to change route without using /sbin/route.
