How to trigger the change? LSWS doesn't do such change either. You can trace the file to see who and when it was being modified. Normally CloudLinux use their version of file copy. You can log a ticket us or with CloudLinux to take a further look. we will need your server access.