Experimenting with this, looks like the content leak is inside Berkeley DB code. The leak is always on offset X*4096 bytes away when the database pagesize is 4096 bytes. Looks like this is an important hint, since Python itself knows nothing about database pagesize.

For instance:

>>> a=open("secrets.db").read()
>>> a.find("secret")
21184
>>> a.find("secret",21185)
25280
>>> 25280-21184
4096
>>> a.find("secret",25281)
37568
>>> 37568-25280
12288
>>> 12288/4096.0
3.0