I'm suspecting this is incredibly easy, even obvious, and I'm soon to be embarrassed.

SuSE 15.2, running KVM server and at least one VM: both SuSE Linux, both with a Gnome desktop.

When I come back to the computer, often I need to type in the user password for the VM, and sometimes for the KVM first then the VM.

In any event, during all that, sometimes a system message or two flashes at the top of the screen. It's generally too quick to react, and not sure where it's coming from (server or the VM).

Where do I go to find out who was flashing what to me so I can deal with the issue?

It's more than likely uncle Sam that took your picture through the webcam, maybe even embedded some subliminal message in your mind causing you to panic.

Anyway, you can open a terminal and run the command below, may need to run it as root or sudo but try as user first.
This should show most everything that took place in the last two minutes.