DOMAIN_CURRENT_SITE constant being regularly overridden

A few times now, our site's DOMAIN_CURRENT_SITE constant, stored inside wp-config.php has been overridden by what appears to be a reverse DNS of our sites IP address... Since we use AWS elastic IPs, this turns out to be something like aws.12345146.someothertext.aws.com instead of www.ourdomain.com. When this happens, the site becomes unreachable.

The DOMAIN_CURRENT_SITE value needs to be reverted, and we also need to run a few updates on the database to restore some urls there.

The last two time this has happened it was Friday morning, so we suspect an automatic update (plugin perhaps) or process. An audit log plugin shows Yoast SEO and Gravity Forms updated early this Friday, but nothing appears for the Friday prior, so that may be a red herring.

Logging is currently disabled and I can turn it on, however I would like to reserve allowing the site to fall over again next week only as a last resort, as when that happens it is a Bad Thing^tm.

I can submit a request to change the reverse DNS result for our elastic IP however I would prefer to fix the cause of the issue rather than the symptom.

Anyone have any ideas?

Update: to re-iterate, the database also needs an update run to remove the new url in a few places, meaning I can't only make wp-config.php read-only and call it a day... the db changes are, specifically:

UPDATE wp_options SET option_value = 'http://www.ourdomain.com' WHERE option_name IN ('siteurl', 'home');
UPDATE wp_site SET domain = 'www.ourdomain.com';
UPDATE wp_sitemeta SET meta_value = 'http://www.ourdomain.com' WHERE meta_key = 'siteurl';
UPDATE wp_blogs SET domain = 'www.ourdomain.com';

I've installed a cron viewer for wordpress scheduled jobs, and snapshot-controller-full-cron-start_backup is run 1am Friday mornings, and may be the cause. Haven't been able to locate and further info.