I don’t think there are any logs
1. User or a job might move splf to queue with printer
2. Outq might be attached to printer for some job
3. OutQ is cleared by some job – could be part of weekend clean-up?
Recommend that you change the print file to SAVE(*YES) or ovrride in the job to SAVE(*YES).
This isn’t going to help if it’s removed by the weekend clean-up.
One command which deletes spool files is Taatool.dltoldsplf, which will delete spool files > X days old. Of course there are other ways of deleting spool files but something like this could be happening.