It sounds like there may be a scheduled task of some sort doing a calculation and writing a single value every Thursday at that time.
What version of the PI Data Archive are you running? If you are running version 2017 or later, there is a tuning parameter Snapshot_TracePointID that you can use to enable tracing for the troublesome tag. This will record to the message log the application, machine name, and user that wrote a value to the tag which would be extremely helpful in tracking down where the odd writes are coming from.
How many users do you have using the workbooks? Also, are the data writes from the workbooks buffering via PI Buffer Subsystem? If the workbook writes are buffered, we may still be able to track how the data is being written. If you run "piartool -sd <tagname>" on the PI Data Archive, you can see the buffer source ID that last wrote to the tag. Then, running "piartool -bfs" will show you all the buffered sources. You could use this to find the machine writing the values. You would probably want to time running these commands immediately after Thursday at 6:00am, and if the write is buffered, you will be able to find the machine it is coming from.
Otherwise, tracking this down will be more tricky. Since it's on a schedule, I would perhaps start by reviewing task scheduler on machines running the workbook and see if anything suspicious shows up.
That's the thing, there is only one workbook, and one user entering data each few hours. All other hour entries are logged correctly.
It isn't scheduled, the user picks the timestamp and enters the value, then clicks the record button.
Just on Thursdays, and only at 6AM