In my COS12 (Android 5.0.2), I noticed that whenever the volume was changed an intent was broadcasted with action
android.media.VOLUME_CHANGED_ACTION and that was all I was able to see using dumpsys or logcat. The extras in that intent did not contain anything useful to trace the app.
Anyhow. Following is what I can recommend as an approach and as of now:
Install aSpotCat1, uncheck Ignore system apps from its settings and under List apps by permission browse the section Audio Settings. This app missed some system apps which my answer here took care of2.
(Click image to enlarge)
I suggest you check View app's full package name? and find out the package name of all the apps listed by aSpotCat. After that, uninstall all the user installed apps involved. Since removal may not be a preferable option for you, you can consider hiding/blocking them. Setup adb in PC and do:
adb shell pm block PACKAGE # for KitKat
adb shell pm hide PACKAGE # for Lollipop
PACKAGE should be replaced by package name of the app. In short, the effect observed from that command is akin to removing an app from your OS with major difference that the app's data and UID would remain preserved.
To reinstate the app, replace hide by unhide and block by unblock in aforesaid commands.
You would have to wait and observe if the volume is getting changed. If yes, hide/block/remove those user installed apps singularly or in bulk and then go into observation mode again. If all the user installed apps are removed yet the change in media volume can be observed then a system app is involved in the process. If you've a custom recovery installed or you're ready to factory-reset the device, only then you should consider hiding/blocking/disabling a system app listed by aSpotCat since the stability of the OS can be affected.
As you would have guessed by now, this is a messy solution, relies on trial and error and doesn't guarantee much that you would be able to pin-point the app. However, I don't think there is any way to easily pin-point the app affecting the media volume.
1 You may try any permission checker app. The helpful list maintained by user Izzy on his website may come handy.
2 Input the permission android.permission.MODIFY_AUDIO_SETTINGS.