I'd use the Canvas API to fetch the course enrollments to see when they were dropped. If you've not used the API here's an easy workaround:
- Visit the home page of a course at issue.
- Get the course ID number at the end of the browser URL.
- Open another new browser tab.
- In the new tab, visit https://yourschool.instructure.com/api/v1/courses/course_id/enrollments?state[]=deleted&per_page=100, where yourschool is your Canvas domain and course_id is the ID number from step 2.
This will give you a JSON-formatted response with each dropped enrollment (or, at least, the first 100 of them). Look for the updated_at field for the UTC datetime of the deletion. This might give you a breadcrumb of when the deletions occurred.