In my production environment some SharePoint sites automatically blocked

To audit who blocked the SharePoint sites, you can use the audit log in Microsoft Purview. Here are the steps12:

1. Sign in to the Microsoft 365 compliance site using an account that has been assigned the appropriate audit permissions.
2. In the left navigation pane of the compliance portal, click “Show all” and then click “Audit”.
3. On the Audit page, configure the search using the necessary conditions.

Please note that you have to be assigned the Audit Logs or View-Only Audit Logs roles in the Microsoft Purview portal or Microsoft Purview compliance portal to search the audit log1.

As for the root cause of SharePoint sites getting blocked automatically, there could be several reasons345:

1. Site Policies: SharePoint sites can be automatically closed and deleted based on site policies. These policies define the lifecycle of a site by specifying when the site will be closed and when it will be deleted3.
2. Throttling: SharePoint Online uses throttling to maintain optimal performance and reliability of the service. Throttling limits the number of user and admin operations to prevent overuse of resources. If usage limits are exceeded, SharePoint Online throttles any further requests from that client for a short period4.
3. Permission Issues: If the permissions for the affected user aren’t configured correctly, or if there’s a mismatch between the account used to access the shared link and the account to which the sharing invitation was sent, access to the SharePoint sites could be blocked5.