This may help. I've noticed when the app I'm in suddenly drops to the desktop, it doesn't appear to really be the Finder that's active. Rather, some other background process has jumped to the foreground, but its name doesn't show at the upper left because it's not meant to be seen.
I found this discussion about it. Look in particular at the second entry (with 21 likes). It's a rather simple Python script that prints the name of whatever app is currently in over the foreground every 3 seconds. For the user who posted the script, it helped them discover the culprit was SymUIAgent.app.
It's a bit hard at first to understand what you're supposed to do with the information since it isn't described well, but it's actually very simple. Grab this text:
#!/usr/bin/python
from AppKit import NSWorkspace
import time
t = range(1,100)
for i in t:
time.sleep(3)
activeAppName = NSWorkspace.sharedWorkspace().activeApplication()['NSApplicationName']
print activeAppName
Copy/paste it into a plain text, TextEdit document. Save it as any name you want, just so long as it ends with .py . The author used find_focus_stealer.py since that makes it easy to remember with that Python script is for.
Open Terminal and type python, followed by a space. Drag and drop the TextEdit document you just created into the Terminal window. It's location and name will be added to the command you started. Press Enter.
The script will now print out the name of whatever the foreground app is every three seconds. Just leave it running in the background as you work. When the Mac drops to the desktop, refrain from pressing anything until the script records what just took over the foreground. That's the troublemaker.
I have a lot of third party stuff loaded because it needs to be there for various third party apps and hardware. My suspicion is the Wacom driver, but it could be something else. I've only run it long enough so far to see that, yup, the script works.
