It's most likely the WordPress Heartbeat API introduced in WP 3.6.
Using the WordPress Heartbeat API
The Heartbeat API: Changing the Pulse
I've not done this myself, so I'm not sure if this is the complete solution, but you should be able to add this to functions.php to stop the API:
remove_action( 'admin_init', 'wp_auth_check_load' );