I've been trying to find what it is that keeps overwriting /etc/resolv.conf

  chattr +i /etc/resolv.conf

and watch the logs for errors/crashing services. It's sad, I know, but sometimes you do need a landmine to identify the trespassers.