There's a handy Python script here to show log which application is stealing focus: https://superuser.com/a/874314
If you find it's SecurityAgent then you might be hitting this bug: https://developer.apple.com/forums/thread/807112
I suspect it's related to a JIT privilege management app my company uses.