We too have had this problem.  We first noticed it in mid-April, and it always happens after a Lacerte update runs. 

After much back & forth between our IT contractor and our firewall provider,  they think it's caused by the new way Lacerte runs program updates this year. Rather than overwriting the previous version, Lacerte puts the entire new program file in a subfolder of the old one, effectively undoing the whitelisting every time the firewall provider has set it. 

Also, our tech says Lacerte encrypts the files AS they are written, which is how ransomware behaves, and therefore, the firewall sees it as suspicious.

Our tech thought it was *finally* solved - many times, really, but for sure last week when he explained the above theory to me.  AAAAnnnd...it happened again yesterday!! So who knows????