That is correct. In the SmartThings setup, only a User or a SmartApp can initiate a command. The DTH is a layer that sits in between the Requestor (User interface or SmartApp) and the Actor (device/lock). It’s job is translate the request/command (e.g. Lock) into a protocol (eg zigbee, zwave, WiFi etc) sequence which can be understood by the lock. Hence the DTH never sends an unsolicited action since it’s event driven and needs a user/SmartApp to initiate an event.
Yes there are lots of logging options available in SmartThings depending on your comfort level. The most basic and best logging / auditing option is the Recently tab on your device page. Then there is the Live Logging option in the IDE. Also, in the IDE you can also audit the events for each device which includes information about the Requestor and the Actor including the raw protocol data. Most of the times the Recently tab is sufficient to debug things like this.
You’ve isolated the issue in this image. There is a SmartApp or a routine called “Unlock It When I Arrive” which sent the “Unlock” command to the DTH. That’s the Requestor behind your mystery unlocks.
If it’s connected to your presence sensor you may want to check how it’s setup. There are many topics on how presence sensors work and how there may be false positives or triggers leading to unintended actions executing.
Hope this helps.