SharePoint automatically adding Network Service account to the IIS_Users group

My current client has their security locked down and they get an alert when any user is added to a machine group.  So right now they are getting alerts several times a day because the Network Service account is getting automatically added to the IIS_Users group by a SharePoint service account.  Any idea where this might be happening within SharePoint?

Thanks!