FGT default enable "set revision-backup-on-logout enable " with CLI:config sys global /set revision-backup-on-logout enable /end
So if Login session change setting but did not back up to flash, when this admin session logout or timeout, FGT will automatically save revised setting to flash, and you will see that event log (logid=0100032400) for it.
Many thanks for your answer.
Effectively yesterday morning I started a cli session from a remote site to change a firewall rule but after I moved to an http session using an ssh tunnel so probably one of the two sessions was left opened by mistake.
Since the message came after several hours I didn't think that was related to the early morning change.