I would suggest temporarily substituting gnu tar on that machine with a shell script that prints out its arguments

That way you can find out with which arguments tar is called by this process.