If I had to deal with something like this, I'd go to extended events. You can capture events like object_altered, object_created and object_deleted to see what was done within the system. The events include database_id, ddl_phase, index_id, object_id, object_name, object_type, related_object_id and transaction_id. You can add the Actions like client_hostname to get the name of the machine calling for the change, nt_username to get the login, or username to get the SQL login.