Test, Dev and production are 3 existing, seperate environments. Sites are built and then moved via stsadm. It seems to happen directly after being crawled by the index server, go figure.
We don't have an answer from Microsoft yet, but if/when we do, I will make sure and let everyone know.
We are running Win2ks, SPS-SP2, WSS-SP2. Enabling NetIQ Security Manager exacerbates the issue, so there ya go.