Before disabling SIP, I found I could use fs_usage to get some visibility into fs changes:

sudo fs_usage -w -f filesys | grep aliases.py

To test my understanding of fs_usage, I deleted aliases.py (also confirming that triggers the error). When I did so, I noticed something interesting - my Dropbox account detected deletion of 34 instances of a file called aliases.py. A quick search reveals that I have about 34 virtualenvs created by tox, each of which links .tox/python/lib/python3.6/encodings to /Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/encodings.

Now I'm suspecting that there's a race condition where Dropbox ends up deleting the system file. Either that, or there's a buggy piece of code somewhere that's deleting encodings/aliases.py (and possibly other files) in one of these virtualenvs, causing the file to be deleted in the system.

I'm using Dropbox v16.3.27 (https://www.dropboxforum.com/t5/Desktop-client-builds/Beta-Build-16-3-27/td-p/197057).

I'll continue to investigate, but I'm becoming increasingly suspicious of this being an environmental problem.