This is something I've recently noticed happening on Magento CE 1.9.2.2. The code responsible is at app/code/core/Mage/Sales/Model/Order/Payment.php:492 which has a strange to do note in the comments: TODO: eliminate logic duplication with capture()
I am trying to work out the root cause here. There aren't other obvious events that Magento will be firing at those times (other invoices or orders that are generated around the times listed above).
Is it possible that PayPal is actually sending these notifications?
What would be triggering this?
I am using PayPal Express.
UPDATE
It does seem to be PayPal's IPN triggering capture():
store_ssl_access.log:173.0.81.1 - - [17/Dec/2015:12:26:27 +1100] "POST /paypal/ipn/ HTTP/1.0" 302 4443 "-" "PayPal IPN ( https://www.paypal.com/ipn )"
store_ssl_access.log:173.0.81.1 - - [17/Dec/2015:12:26:30 +1100] "POST /customer/account/login/ HTTP/1.0" 302 7238 "-" "PayPal IPN ( https://www.paypal.com/ipn )"
store_ssl_access.log:173.0.81.1 - - [17/Dec/2015:13:09:14 +1100] "POST /paypal/ipn/ HTTP/1.0" 302 4443 "-" "PayPal IPN ( https://www.paypal.com/ipn )"
store_ssl_access.log:173.0.81.1 - - [17/Dec/2015:13:09:17 +1100] "POST /customer/account/login/ HTTP/1.0" 302 7214 "-" "PayPal IPN ( https://www.paypal.com/ipn )"
store_ssl_access.log:173.0.81.1 - - [17/Dec/2015:13:27:33 +1100] "POST /paypal/ipn/ HTTP/1.0" 302 4443 "-" "PayPal IPN ( https://www.paypal.com/ipn )"
store_ssl_access.log:173.0.81.1 - - [17/Dec/2015:13:27:36 +1100] "POST /customer/account/login/ HTTP/1.0" 302 7232 "-" "PayPal IPN ( https://www.paypal.com/ipn )"
store_ssl_access.log:173.0.81.1 - - [17/Dec/2015:14:34:40 +1100] "POST /paypal/ipn/ HTTP/1.0" 302 4443 "-" "PayPal IPN ( https://www.paypal.com/ipn )"
store_ssl_access.log:173.0.81.1 - - [17/Dec/2015:14:34:43 +1100] "POST /customer/account/login/ HTTP/1.0" 302 7226 "-" "PayPal IPN ( https://www.paypal.com/ipn )"
store_ssl_access.log:173.0.81.1 - - [17/Dec/2015:14:59:19 +1100] "POST /paypal/ipn/ HTTP/1.0" 302 4443 "-" "PayPal IPN ( https://www.paypal.com/ipn )"
store_ssl_access.log:173.0.81.1 - - [17/Dec/2015:14:59:22 +1100] "POST /customer/account/login/ HTTP/1.0" 302 7220 "-" "PayPal IPN ( https://www.paypal.com/ipn )"
This is only a small part of the server log however I can confirm the times of the order comments and these IPN calls actually match.
