How can I find what's starting crond?

I need to stop crond at the command line. (I'm writing a script which needs to stop it, do some work, and then start it again. I'd rather not remove and replace the crontab file because it's more prone to error.)

However, when I run service crond stop or sudo /etc/init.d/crond stop, it stops but is started again less than a minute later.

[root@prod-sphinx1 ~]# service crond stop;date
Stopping crond:                                            [  OK  ]
Wed Oct 15 05:48:50 UTC 2014
[root@prod-sphinx1 ~]# ps uefxxx | grep crond
root     11891  0.0  0.0  61192   788 pts/0    S+   05:49   0:00          \_ grep crond HOSTNAME=sphinx01.us-east-1.zoomingo.com TERM=xterm-256color SHELL=/bin/bash HISTSIZE=1000 SSH_CLIENT=50.46.219.220 51260 22 SSH_TTY=/dev/pts/0 USER=root LS_COLORS= EC2_HOME=/home/ec2 MAIL=/var/spool/mail/root PATH=/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/home/ec2/bin:/home/ec2/bin:/root/bin INPUTRC=/etc/inputrc PWD=/root JAVA_HOME=/usr/java/default LANG=en_US.UTF-8 PS1=[\u@prod-sphinx1 \W]\$  SSH_ASKPASS=/usr/libexec/openssh/gnome-ssh-askpass SHLVL=1 HOME=/root LOGNAME=root CVS_RSH=ssh SSH_CONNECTION=50.46.219.220 51260 10.146.200.111 22 PKG_CONFIG_PATH=/usr/lib/pkgconfig:/usr/local/lib/pkgconfig LESSOPEN=|/usr/bin/lesspipe.sh %s G_BROKEN_FILENAMES=1 _=/bin/grep
root     11875  0.0  0.0  17832  1044 ?        Ss   05:49   0:00 crond MONIT_DATE=Wed, 15 Oct 2014 05:49:21 +0000 MONIT_HOST=sphinx01.us-east-1.zoomingo.com PATH=/sbin:/usr/sbin:/bin:/usr/bin PWD=/ MONIT_PROCESS_PID=0 MONIT_EVENT=Started MONIT_PROCESS_MEMORY=0 SHLVL=2 MONIT_PROCESS_CPU_PERCENT=0 MONIT_SERVICE=crond MONIT_PROCESS_CHILDREN=0 MONIT_DESCRIPTION=Started _=/usr/sbin/crond

ps -l says the parent process ID is init (not surprising):

[root@prod-sphinx1 ~]# ps -l -p11875
F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
1 S     0 11875     1  0  78   0 -  4458 -      ?        00:00:00 crond

And pstree says:

[root@prod-sphinx1 ~]# pstree -p 11875
crond(11875)───crond(11905)───sh(11907)───index-minutely.(11908)───indexer(11910)

Which gives me the processes it's running, but not the process that started it.

Unfortunately, pstree was the best my Google-fu could dig up. What can I do to figure out how this thing is getting started?

Edit: the box is running CentOS 5.6:

[root@prod-sphinx1 ~]# cat /etc/issue
CentOS release 5.6 (Final)
Kernel \r on an \m