Xymon-client was not completely dropping privileges at startup.

While xymon-client knows internally what UID it should run as, a
design flaw in the rc script was still launching its master process as
root. As a result the following two processes were always running as
root instead of the xymon user:

/usr/local/www/xymon/client/bin/xymonlaunch ...
sh -c vmstat 300 2 ...

The rest of the processes the xymon-client runs such as df, netstat,
top, custom scripts, etc were correctly executing as non-root.