You have noticed that SEP accesses /var/tmp/I2_LDVP.TMP/dec/ and would like to know why.
SEP Linux
This is expected behavior.
The folder "i2_ldvp.tmp" is used as a temporary location for the files which are getting extracted from the compressed files during scans.
Such files are being removed once scan is completed.