Hi Thomas,
Sorry but maybe I've explained myself poorly. You said that business roles that were missing are normally assigned directly in SU01. Then, in order to try to understand how they are remove, in SU01 transaction there is a functionality that allows you to see the change history for every add/removal of a role. This will tell you the user that performed the action and which tcode he used.
Check this functionality that it's available as a menu option in SU01. Maybe it can give you some good clues about what's happening.
Kind regards,
Garcia