Sysinternals tools will show up the writes and what is causing them.

I've dug down and found random things doing dumb stuff in the past. Verbose logging turned on by default for some services, for example.