Tracking Down a New Recurring Pop-Up in macOS 15

[McAwesome]

I'm working through the usual new macOS approval process for my org. Everything checked out on my test machines, so I updated my daily driver. Now, every 30 minutes or so I am getting a popup that is new to macOS 15 saying "sudo is trying to execute a command as administrator." Clicking "Cancel" makes it pop up again a few seconds later, and authenticating with an admin makes it pop up again about 30 minutes later. I like this popup in theory, but as implemented it doesn't give anywhere near enough information to figure out why it is showing up or if it's a valid request.

I've ruled out our in-house launchagents and the like, and it doesn't seem to be happening on test machines with normal user programs installed. That makes me think it's tied to some admin related tool like Jamf Sync, Packages, autopkgr, or something else that most users won't have installed. Alternatively, it could be some driver set like the LogiOptions+ needed for some keyboards.

Is anyone else seeing this recurring message on macOS 15? Anyone have tips on tracking down what causes it? If I can't explain it, I'll likely end up having to treat it as a deployment blocker.

[jamf-42]

while that is open.. a 

ps aux | grep sudo 

should pop something out? 

[McAwesome]

That seems to point me to either wireless or Jamf Remote Assist, but neither of those seem likely to me.  Removing the instance of me running the grep command, here's what it pops up.

root 5584 0.0 0.0 410885504 10400 ?? S 12:01PM 0:00.06 /usr/bin/sudo /System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport -I

root 1566 0.0 0.0 410908992 8432 ?? S 11:32AM 0:00.01 /usr/bin/sudo -u [REDACTED USER NAME] /Library/Application Support/JAMF/Remote Assist/jamfRemoteAssistConnectorUI.app/Contents/MacOS/jamfRemoteAssistConnectorUI

[whiteb]

Launch Jamf Composer and have it look for new and monitored files. Wait for it to be ready. Enter admin creds at that prompt, then after a few seconds hit done in Composer and see what exactly got touched. Might give you clue.