Some additional information: It looks to only be doing this around November, then is back to doing the 1st at 12:00AM by April. This generates dates over a period of years so this occurs every year once on the cloud.
The contractID 6525b9c4380d1909714f7306 payments reflect what I'm talking about for anyone looking at the data. I am happy to provide a db login as well.
Didn't mean to delete my original post- it was timezone stuff, I should have realized 🙂