We are seeing the same thing in two different environments. Do you have redundant ELM's setup in your env's?
We had a call today with McAfee and mentioned mount/unmount spamming and a support ticket will get created. It looks related to the rsync_copy process from the redundant elm but need to dig in a bit more.
nothing in the logs so far but /etc/mtab is getting updated at least on the one machine I looked at.. Will keep everyone posted.