Your guess is likely correct. There are a number of stumbling tools which will randomize the MAC, at least on startup:

http://www.dachb0den.com/projects/dstumbler.html

I haven't seen any that randomly change during runtime, except perhaps some of the odd Linux shell script scanning routines still floating around?