Thanks guys!
System did not reboot (uptime 218 days). Unfortunately it looks like syslog and dmesg aren’t configured on my box to retain logs more than a day, so I don’t see anything from around then.
I do see a lot of messages (every 10 minutes or so), still ongoing, like this:
Oct 24 10:35:03 forum kernel: [18839676.542030] type=1400 audit(1508855703.196:112881): apparmor="DENIED" operation="ptrace" profile="docker-default" pid=27630 comm="ps" requested_mask="trace" denied_mask="trace" peer="docker-default
Not sure how that would be related, though.
Anyway, if it happens again, I know now to check syslog + dmesg right after the incident – I appreciate the help.