Every 15 minutes vasd force updates the access control groups, then re-processes the pwent/grent tables. This is useful for situations where group membership is asked for without a login, when the hide-if-denied option is enabled, and a couple other edge cases. These situations are common enough that in general we enable it, but it usually is safe to disable if necessary, for example if the processing every 15 minutes results in problematic CPU usage.
To disable this periodic processing, touch the file "/var/opt/quest/vas/vasd/.disable_ac_group_updating". When disabled updates still happen on the normal interval (lazy-cache-update-interval), and when a user logs in then all of their account memberships are updated for them.