Here asre some of my initial thoughts:
1. Did you look at QHST during these timeframes? That may show some other activity that you were not aware of.
2. Was there any change in memory alocations?
3. Was there any change in job run priorities?
4. Was there unusual activity accessing the machine remotely during this time frame.