Even with impersonation it's possible that your app pool identity is used. Some apps RevertToSelf and don't honor the impersonation.
Process monitor from www.systernals.comsysinternals will be your friend on this project. It's free and safe on a production server. Start it and reproduce the situation to get a capture. Then search for the word denied, or search for CustomSD or Eventlog. A pattern should emerge that will show which user is trying to gain access and how to grant that user access.