Hello ANG,
It looks like an internal call actually. Not sure why to use a SYSTEM user instead
Anyhow, any chances someone reactivated it executed a few statements and deactivated it again?
As per documentation Deactivate the SYSTEM User - SAP HANA Security Guide - SAP Library that's a possibility.
Maybe start monitoring ALTER USER would help investigate if that is the case.
Cheers,
Lucas de Oliveira