There was an undocumented feature in an older version that would cause this when a line item was deleted from a SO, this was fixed in a PU.

do you have a link to a discussion on this at all? we are on 2014 PU3

No - it's buried somewhere in my 20 years of experience. I don't think it was on 2014 though, it was an older version.
Run the IC data integrity with the fix option and then monitor it.
Do you have any 3rd party products? Service Manager also nuked OE data at some time.

we have a bunch of 3rd party stuff. All Sage verified though like Tairox, Inter Entity Transactions and such...

If there was something in the past about it, I'll use the Alert Server to create an alert to look for deleted lines. If that's what the actually culprit is, then I will just have a training situation on my hands as I don't think there is a way to stop a deletion of lines (except after a first shipment).

Thanks for the pointers. I'll start with this path as see if it helps. I know things can happen from time to time, I just seem to be seeing it more often lately so wanted to nip it in the bud if possible.

Good thinking.