Client machines were upgraded to Symantec Endpoint Protection (SEP) 12.1. Since then, unexpected scans are executed on computers, whereas they are not configured in SEP client policies.
Scans left behind during migration process.
1. Open regedit
2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\Scheduler\[-GUID-]\Custom Tasks
3. For each [-GUID-], backup then remove legacy scan registry keys
Client machines with SEP 12.1.