osTicket "randomly" runs auto cron on staff activity to take care of some back end cleanup etc. But unless you are going to the url for it, it shouldn't ever direct the Agent to it. It just runs in the background.
The logs that you provided do not provide any insight as to what might be going on, but it sounds like you have some sort of htaccess level or site level redirects going on. You might want to look at those first.
I have never heard of something like this happening before so I'm not real sure where to start other than the redirect should be getting logged some where. You might want to look for more logs. (mod_security? SELinux? Apache Access logs?)