Hey @HorizonApp!
Retool's audit logs may be one solution to let you inspect what queries are being run. If you're running Retool on-premise you might also be able to check your container logs for those periods for any errant behavior.
Otherwise, if you're still seeing this issue and are convinced the calls are coming from Retool feel free to write to us through Retool itself and we can take a closer look at things!