I've been attempting to solve this one for a while now. Straight to it,
I've been investigating this issue for months it's hard to pin down because it doesn't happen with each upgrade. I've noticed it happens predictability with a kernel upgrade, however this last time there was no kernel upgrade and I'm at a loss as to how find the script that runs during the update.
I managed to collect what I hope is a vital clue to this mystery. During the latest apt upgrade the packages initramfs-tools reported iF installed ok halF configured this package wasn't included in the upgrade.
I've rewritten the initramfs hooks for kernel upgrades and deleted the old ones. I can verify 100% these didn't run.
My setup uses an initramfs to display a boot splash and set some system values. From what I can tell the initramfs is being updated for some reason and during that process a backup or something is created but it's much larger than original. I can also verify that the boot partition is large enough to hold two initramfs files as I have complied one for a pi0 and pi3 on the same SD card with space to spare.
Now I'm stumped not sure where to go from here.