Magnus,
First, you should check whether it's actually a Google Ads script making the changes. In Google Ads, check out Tools - Bulk actions - Scripts. When the account is part of an MCC, do realize you can have scripts on account level and MCC level - check both.
Assuming it's not a script:
In Google Ads (on the web), go to the change history of one of those changes. You should see out who made those changes - that is the person that allowed some software to access your accounts.
Don't know that person? Kick him off your account.
You know the person or it's actually you? Ask that person to visit
Google account security, and then click the link "Your connections to third-party apps and services". That shows a list of all software that was granted access to some information of that user. The violating software should be in there. That list has functionality to block access of individual apps.