Randomly, we are seeing process instances getting created where the initiator variable gets set to the system user instead of the user actually authenticated for the REST call.

The problem is related to a custom NotificationListener implementation that is slow to execute. If another REST call happens at the time this custom class is execution, this REST call is affected by this issue.