I had a similar incident with a cheap, 360, cam I bought off of Aliexpress. It was not going to be a security cam, just a cam to keep an eye on some seedlings in a grow box. I set it all up and would review the video of the seedlings sprouting. Then I noticed an weird behavior. At 5:00 AM it would automatically pan and stop, then repeat.

At the time we were experiencing some heavy electrical storms in our area and I have a Woody doll that sits up on a shelf in my lab. When we get electrical storms in this area, my Woody doll will introduce himself all on his own. 'Hey howdy hey! My name's Woody!' It'll freak you out if you didn't know it does that. The Woody doll has a pull string voicebox and I haven't pulled the string in years. I attribute the phenomenon to static charges in the air that activate the voicebox somehow.

So the panning I attributed to this static electrical charge during electrical storms. However, it started becoming a schedule. At 5:00 AM~ it would begin panning. So I got into the guts of the cam and the software. Turns out, no matter what DNS you used, one was already hard coded (1.2.4.8) along with other network settings, into the firmware and seemed to bypass any setting you punched in. The cam operated as a normal cam would and for what I was using it for, it did the job, except for the early morning panning.

So, great, I've allowed a nefarious actor into my network. I removed the cam off the wifi, and destroyed it. Combed through the network for any signs of exfiltration or other angles of attack and found nothing, except that I had pretty much set up a cheap, Trojan horse on my network.