As ultimitloozer suggests Process Monitor is a good choice. One drawback is the volume of output it produces. It can be reduced by spending some time configuring its exclusion list. Or if you are facile with a good editor you can quickly exclude unrelated records from a large output.

You don't mention how long a space issue event lasts. If it's on the order of a minute or more then I would do the following as a first approach.

Create a script that every 20 seconds:
1) echo %date% %time% >> file
2) runs Sysinternals Pslist >> file
3) runs Sysinternals Du -q -l 1 [target] >> file

Where [target] is either entire drive e.g. c:\
or a dir if the space problem is in a known dir e.g. c:\data

The Pslist data will point to which program is getting CPU
The Du data will show where the space usage is occurring.

After an occurrence or two you can narrow the Du [target]

When really close add to the script a
4) dir /a /s /od [target] >> file

and perhaps comment out the Du

I know from long experience that on any decently performing server such a script will have little detrimental impact on performance.

edit: [target] was missing