Recently a number of entries were made in the Audit Log with the following pattern:
deleted WPHB Minify Group "34970c23330f783c770f6daea8099319-scripts"
Context Type IP address User Date / Time
WPHB Minify Group Content 220.127.116.11 Guest December 9, 2017 3:24 am
There are a lot of entries like this and there is no user associated with the entry. Many of the entries have different user IP but there are some clusters.