Is there anything other than the HMI that could be writing bits? Like a servo controller IO card? Or some other IO card in the rack that the PLC program itself doesn't refer to, just reads the bits & words written by it?
Another thought - maybe the PLC is writing a word that this bit is part of, and then later only checking this bit of the word.
Any chance there's a PC or a weld controller with a profibus or profinet card in this machine?
Too big.