Hello
Thank you for your question and reaching out.
You can only find out through auditing. The security event of the DC where the OU move originated would need to be checked.
If an object is moved from one organisational unit to another, event ID 5139 is registered.This event records the transfer of an AD object from one OU to another, identifying both the old and new locations of the object as well as the user that transferred it.
--If the reply is helpful, please Upvote and Accept as answer--