I think you're onto something with the subdomain, since posting the above I've found 2 entries where PHP had incorrectly been disabled overnight and both were on a subdomain so it seems like this could be significant.
I've experienced the same this morning after Plesk updated to Version 18.0.27 Update #1
My action log similarly shows:
'PHP Support': 'true' => 'false'
Coinciding with the time that the SSL certificate was auto-renewed.
The subscription in question was locked to a plan where the plan has PHP...