This Mac has "
RansomWhere?" installed. If it observes unusual file activity, particularly processes interacting with Apple-signed files, it'll prompt you like this.
A few programs (Acrobat Reader is really bad about it) will touch Apple-signed files for whatever reason, causing this prompt to come up.