I stopped using atop when I found it installs several hooks which automatically run code as root and deposit files around the filesystem, including a "power management" hook.
installed by default in most distributions, e.g. https://packages.debian.org/bookworm/amd64/atop/filelist