Did you check all of your identity profiles? Also, transforms can be used in the “Create Account” and “Attribute Sync” features of a source.
You’ll want to use the list provisioning policies API for each source that you suspect this is happening on to see if that transform is being used.