Change Auditor may record a "Domain controller moved to site" event for a member server that is not a Domain Controller. The events will appear similar to the following. Make note that the "Who" for the event is the computer account of the member server that was "moved to site":
A "The Domain Controller has been moved to site" can be generated when MSMQ is installed on a Member Server with the "Routing Service" option enabled. When installing this service, Windows prompts to ensure the correct permissions have been applied to the AD site (as per https://technet.microsoft.com/en-ca/library/cc749102(v=ws.10).aspx). Once the feature is installed, it attempts to add a new object to the Sites container (CN=Servers,CN=<SITE_NAME>,CN=Sites,CN=Configuration,DC=domain,DC=com). If the permissions have not been granted, a failed "Domain controller moved to site" event will be recorded. If the permissions are granted, a successful "Domain controller moved to site" event will be recorded.
To verify if installing MSMQ on a member server caused the event, review the Windows Event Viewer System log on the member server and confirm if an event similar to the following was recorded at the same time as the "The Domain Controller has been moved to site" event: