Burst.NET cloaking processes in dedicated servers?

I have 6 dedicated servers in Wooservers (a reseller of Burst.NET). I monitor CPU with rrdtool. I'm getting these strange charts:

http://i.imgur.com/YAu8q.png http://i.imgur.com/LQiuP.png

exactly at 00:00 my servers either stop or start processing something according to rrdtool, although there's nothing started/stopped by me. I look at ps/top and nothing shows either.

i've been scratching my head for the last month and can't come up with an explanation... aside from the crazy idea that these guys modified the kernel (they installed ubuntu for me) and somehow are cloaking processes. Any ideas?? Thanks!