This is the setting. This screen is accessed by systempropertiesperformance.exe. This setting needs to be unset for accessability reasons. Every half hour or so, something sets it again. It's not really time based. Leaving the computer idle doesn't do it; but normal usage does.
The problematic behavior of something turning it on started a week ago. Previously, once set off, smooth edges of screen fonts would stay off.
How do I track down what sets it so I can put a stop to it? Normal registry audit audits users not processes.
Please don't come by and say this question is missing the thing that's setting it. The point of the question is I need to know how to find the thing that's setting it.
A comment has been posted suggesting use of ProcMon. This is what the ProcMon filter screen currently looks like:
It should be obvious that's unusable.

