Hello @Dale Erickson
I would check on the Application events or the IIS logs in: %SystemDrive%\Windows\System32\LogFiles\HTTPERR to see the approximate date when it was enabled, for reference.
On the other hand, M365 makes totally sense, as IIS will be one of the requirements on the client due to the "connectors" to the cloud access and data.
Hope this helps in your case,
Best regards!