One thing to checkout is perhaps some plugin/module you have might be adding this permission without you knowing about it.

Trying using the 'Merged Manifest' in Android Studio (https://developer.android.com/build/manage-manifests#inspect...) to see if you can see coming from anywhere.