Like log file rotations of some kind.
They happen late at night when we don't get hardly any visitors and during the day when we get lots. Due to nginx though, I don't think most of our visitors are being passed through into apache.
The key to solving any issue is to precisely and unambiguously define exactly what is (or is not) happening and how this deviates from the norm.