I check all users and could not find another Crontab. The only one existed was for the root user, but it was blank, as was the Schedule stanza.
Did a little digging, thought to grep the log so I did. ( journalctl |grep CRON )
Got the following results (truncated because mostly repeated lines)
Nov 03 16:00:01 AllstarPi CROND[10408]: (root) CMD ((source /usr/local/etc/allstar.env ; /usr/bin/nice -19 /usr/bin/perl /usr/local/sbin/saytime.pl $NODE1 > /dev/null))
Nov 03 16:00:03 AllstarPi CROND[10407]: pam_unix(crond:session): session closed for user root
Nov 03 16:01:01 AllstarPi CROND[10448]: (root) CMD (run-parts /etc/cron.hourly)
Nov 03 17:01:01 AllstarPi CROND[12816]: (root) CMD (run-parts /etc/cron.hourly)
At least variations of these lines.
So I got to probing around in /etc/cron.hourly to try to reverse engineer this. (EE is my major, If you want CSCE you want my (now virtual) Roomate!)
So that brings us to the file /var/spool/cron
Oh boy! I see two files here: root and AllstarPi.tmp.XXXXrkr6BX! Sure the latter is it!
…Both of these files are blank. 
Going back to the grep, I see that the user root (what I am logged in as) is the one running these commands to do the hourly ID… even though when I do either crontab -e or crontab -u root -l all I get is a blank file.
~Jon, K5DVT