If the file maintenance.flag
is created at random times, a user might be the cause. If it is always at the same time, I would bet my money on a module.
When the time at which the site enters the maintenance mode is completely random, I would suggest you check for additional FTP accounts. It might be worth to check the FTP logs of your FTP account as well to see if the file was created via FTP. Change the passwords, if that yields a result.
Also, keep in mind that some hostings offer web-based FTP. Check these accounts as well (if any).
If the maintenance.flag
file is created always around the same time, I would think that there might be a module at work, that for whatever the reason might be, thinks it would be a good time to switch the site in maintenance mode.