Ifigured out what caused this but don't have the solution just yet. Iwould deploy a certain script from a .tar.gz to some servers and found that /root was always owned by user and group "1000.1000". This corresonded to the user who made the .tar.gz.
For some reason when extract normally with "tar -zxvf file.tar.gz" it impacts the parent directories ownership. There must be some recursion going on or possibly the .tar.gz but I haven't f........