Odd security issue with adopted authority

This has worked for several years, and no recent program change, ptfs, or
profile change that we can detect. It worked up to Friday morning...

Looking at an issue where a program that adopts authority (User profile . .
. . . . . . . : *OWNER)
and owner has *ALLOBJ and *SECADM is executing a CRTUSRPRF and not
authorized to the Group Profile of the user to be created.
This is a client job (C#) calling my program

Job . . : QZRCSRVS User . . : QUSER Number . . . : 008237

Message ID . . . . . . : CPF9802 Severity . . . . . . . : 40
Message type . . . . . : Escape
Date sent . . . . . . : 09/14/15 Time sent . . . . . . : 11:4

Message . . . . : Not authorized to object GR_NONXYZ in QSYS.
Cause . . . . . : You do not have the correct authority for object
GR_NONXYZ in library QSYS type *USRPRF.
Recovery . . . : Contact your security officer or the object owner to
obtain the correct authority and try your request again.

This still works in out test partition but not in production.
We allow a select group of users, outside of IT, to manage outside users.
V7R1.
Owner has *ALLOBJ *AUDIT *IOSYSCFG *JOBCTL *SAVSYS
*SECADM *SERVICE *SPLCTL

Program still works fine to change or delete profiles. Only CRTUSRPRF fails
.

Any ideas before call IBM?

Jim Franz