Do the permissions change pretty much immediately? If so I'd subscribe to avenger_jcc's inheritance suggestion.

If the permissions change at some point after the file is droped in there, then I'd look towards a script or similar altering the permissions.

Out of interest, is this inside a share that is managed by cluster (I notice you're running Adv Srvr)?

If you can't track it down from above, then you'll need to enable auditing on your server, and then enable auditing on your file/directory. This is a bit of a pain as it often gives you much more info than you've got time to read but should ultimately nail down the offending task/process.