Auditing an executed job to find who or what triggered an event.

Hello Experts,

I am in need of some assistance.  We had an incident where a few users got removed from a group and i've been tasked to find out how and who did it.  i found the job that did it but it says it was done by "sa" and when i look at created by it says "QBM_PJobCreate"  i've tried to look at the jonqueue logs but it doesn't tell me much...  is there a table or query i can run to see what or who may have triggered this?  Unfortunately, we do not have group membership logged in time trace.

i sure would appreciate your help.

Thanks,

JP