We had an issue today where a Teams site was deleted. Owners of the site reported that it was no longer there. I could not find it in the Teams admin site, but luckily I was able to restore it from the SharePoint recycle bin.
I decided to run an audit using Purview and found that it was deleted by the user "Microsoft Teams Sync". Searching for this didn't turn on much. Does anybody know what this account it?
That's a background service that synchronizes changes from Azure AD and/or other admin interfaces. You should expand the search to cover all workloads, hopefully you can find a matching record with proper user attribution.