When the scheduled auto-update runs, it's been auto-installing the SystemFirewall module, which we intentionally removed due to ongoing problems. In trying to narrow this down, it seems as if the scheduled update for modules is installing "updates" for modules that have been explicitly removed, thus reinstalling them on it's own. Attached is a screenshot of another module it was tempted to install, even though it had been specifically removed.
Module Updates, whether automatic, or based on the "only show upgradable" (and Upgrade All option) should ONLY update modules that are actually installed. Otherwise, it's forcing the installation of modules that are explicitly wanted to be removed.