Did a bit more research, was thinking it might be a systemd service, so I checked for timers there, but there was just a countme timer enabled that basically tells the server to include you in the count of active systems (how to disable, for the paranoid 🥸).
Then I went on to look at the live logs of rpm-ostree and, as found from this website used this command:

journalctl --follow --unit rpm-ostreed.service

So that I could monitor its activity while I open Discover and so I managed to record when it happens, I also saw from the logs that there is a configuration file at this path /etc/rpm-ostreed.confand that you can configure automatic updates from there, by default there a this line about it (usage greatly explained with man rpm-ostreed.conf btw):

[Daemon]
#AutomaticUpdatePolicy=none

but it’s commented out, so it couldn’t have been that.

Finally there is this one thing that pops up in the logs:

Initiated txn AutomaticUpdateTrigger for client(id:cli dbus:1.1625 unit:app-org.kde.discover@df0f43f8979843c0a34d36ad199c7eda.service uid:1000): /org/projectatomic/rpmostree1/fedora

So it is something triggered by Discover, as I had known already, due to other articles that talk about the integration with Discover, but I wasn’t so sure about it anymore, since I couldn’t find any related settings in the app.