Hello,
Thank you for posting in Q&A forum.
Generally speaking, this event log indicates that the system time change was launched by the svchost.exe process.
The Service Host (svchost.exe) is a shared-service process that serves as a shell for loading services from DLL files. Services are organized into related host groups, and each group runs inside a different instance of the Service Host process. In this way, a problem in one instance doesn't affect other instances.
I believe you has noticed that the PID mentioned is 1684.
To further identify the process, please open PowerShell and run
Get-Process -Id 1684 | Select-Object -Property Name, Path
This will provide information about the svchost.exe process with the PID 1684, including the path to the executable.
If next time another PID is logged, please switch 1684 to the actual PID.
To help other customers who may be facing the same issue, please don't forget to vote if the reply is helpful.