I did go through all the instances' errorlog files/window event logs but didn't see any suspicious events.

Thanks