"daily security run output" shows changes in mounted filesystems?

I found in the eMail of "daily security run output" today:

    changes in mounted filesystems:
--- /var/log/mount.today        2016-05-14 03:03:55.000000000 +0200
+++ /tmp/security.aYjsnqDE     2016-11-29 03:04:45.000000000 +0100

..and downstairs

kernel log messages:
+++ /tmp/security.bwlEOxvr     2016-11-29 03:04:49.000000000 +0100
I proof my eMails and see that was not the first time this happens.
I check the logs:
/var/log/mount.today and /var/log/mount.yesterday
but see nothing exceptional.
And do a
#last - no one was there

In /tmp the /tmp/security.aYjsnqD is no more there. I see a directory named /tmp/hsperfdata_root, but it is empty.

Should I concern about that? Or is this normal because of the security checks of the system?