On the DNS server, I'm seeing DNS 520 events. It looks like the host itself is sending dynamic updates to delete the record and that's recorded as a 520 event in the Microsoft\DNS-Server\Audit Log.