Thanks for that - following up on your lead and checking https://www.ubuntu.com/usn/xenial, there seem to have been several unattended security upgrades issued yesterday. We checked several machines' /var/log/dpkg.log and see multiple upgrades around midnight UTC.