Hi!
Even though this question is old I ran into the same thing today. Here is what I have found so far:
In the Windows Events you will find changes on the keystore of Windows here:
Event Viewer > Applications and Services Logs > Microsoft > Windows > CertificateServicesClient-Lifecycle-System
Event Viewer > Applications and Services Logs > Microsoft > Windows > CertificateServicesClient-Lifecycle-User
I will be picking both branches. Within those you find if a certificate has been added or removed, etc.
All the best,
Björn
