root access alert from our IP?

We got an access alert from cPanel at 3am from our office IP and as you'd expect, no one was in the office at the time. I checked the access logs and the root user visited /cpsess**********/json-api/get_autossl_check_schedule and that's all. So I assume this was AutoSSL performing a check. However it does this every morning at 3am but this is the first time we've had an email alert about it. Any ideas why this might be? Thanks,