Can't figure out what program is triggering a Windows display change event

TLDR; a Windows service is triggering a phantom monitor disconnect event which is messing with my screen config in Linux Mint running in VMWare Workstation.

This display event is not affecting Windows, but is causing VMWare Workstation 16 Pro to drop out of multi-monitor mode and causing the Linux Mint guest OS to reorganize all of my windows. This happens 15 to 25 times every 24 hours.

I was able to prove that the culprit was some Windows service by writing a little .NET C# forms program in Visual Studio based on this MS article: https://docs.microsoft.com/en-us/dotnet/api/microsoft.win32.userpreferencechangingeventargs?view=net-5.0

namespace DisplayChangeWatcher
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }

        private void Form1_Load(object sender, EventArgs e)
        {
            SystemEvents.UserPreferenceChanging += new UserPreferenceChangingEventHandler(SystemEvents_UserPreferenceChanging);
            SystemEvents.PaletteChanged += new EventHandler(SystemEvents_PaletteChanged);
            SystemEvents.DisplaySettingsChanged += new EventHandler(SystemEvents_DisplaySettingsChanged);
        }

        private void SystemEvents_DisplaySettingsChanged(object sender, EventArgs e)
        {
            Log(string.Format("{0} - Sender: {1} | Event: {2}", "DisplaySettingsChanged", sender, e));
        }

        private void SystemEvents_PaletteChanged(object sender, EventArgs e)
        {
            Log(string.Format("{0} - Sender: {1} | Event: {2}", "PaletteChanged", sender, e));
        }

        private void SystemEvents_UserPreferenceChanging(object sender, UserPreferenceChangingEventArgs e)
        {
            Log(string.Format("{0} - Sender: {1} | Event: {2} | Category: {3}", "UserPreferenceChanging", sender, e, e.Category));
        }

        void Log(string msg)
        {
            textBox1.AppendText(string.Format("{0} {1} - {2}\r\n", DateTime.Now.ToLongDateString(), DateTime.Now.ToLongTimeString(), msg));
        }
    }
}

Every time the phantom service triggers a config change:

• the logging program logs a trigger to the SystemEvents_UserPreferenceChanging event
• nothing happens in Windows- no screen flashes or windows moving, no indication that an event occurred.
• but VMWare is picking up that change, dropping out of multi-monitor mode, then sends the display config change to the Linux VM
• and Linux is reading it as a monitor 2 disconnected event

To fix it, I have to hit the multi-monitor mode button in VMWare to reconnect the second monitor, and then manually move all my Linux programs back over.

I have not been able to track the source of the event. Could be a Windows service, something from Dell, an Nvidia drivers, or a service related to my docking station (<- this is the one I think it is). Of course, even if I know the source of the event, I do not know that I will be able to do anything to change it. But it is a step in the right direction.

How do I figure out which Windows service is triggering the Win32 event?

• I thought the .NET event args would give me an answer, but they seem to be mostly useless. UserPreferenceChangingEventArgs has a Category property which is "General" when the event comes through.
• Setting a breakpoint and checking the stack trace has not given me anything to go on.
• I dug through all of the main Windows event logs, and a dozen or more of the application logs, but I did not even find the display change event I was picking up in my logger.
• I have also put in a support ticket with VMWare to find out if there's a way in VMWare to disable/ignore display change events.
• I have also posted in the Linux Mint forums to see if there's a Linux way to ignore the display events. But I feel like Windows is probably the right place to solve this.