We use OpenVZ as the virtualisation environment, the servers are cPanel servers.
What software is monitoring the VPSs? If named has started then the monitoring software is reporting a false positive for some reason. Can you do a ps -axf on the VPS in question? (if it is not *BSD)
root@server [~]# ps -axf
Warning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.7/FAQ
PID TTY STAT TIME COMMAND
1 ? Ss 0:00 init [3]
22204 ? S<s 0:00 /sbin/udevd -d
22518 ? Ss 0:00 syslogd -m 0
23553 ? Ss 0:00 /usr/sbin/sshd
7565 ? Ss 0:00 \_ sshd: root@pts/0
7573 pts/0 Ss 0:00 \_ -bash
9890 pts/0 R+ 0:00 \_ ps -axf
23566 ? Ss 0:00 xinetd -stayalive -pidfile /var/run/xinetd.pid
23733 ? Ss 0:00 /usr/sbin/exim -bd -q1h
23758 ? Ss 0:01 /usr/bin/spamd -d --allowed-ips=127.0.0.1 --pidfile=/var/run/spamd.pid --max-children=3 --max-spare=1
23759 ? S 0:04 \_ spamd child
23770 ? Ss 0:00 /usr/sbin/dovecot
23771 ? S 0:00 \_ dovecot-auth
23797 ? S 0:00 \_ pop3-login
23798 ? S 0:00 \_ pop3-login
23799 ? S 0:00 \_ imap-login
23800 ? S 0:00 \_ imap-login
7846 ? S 0:00 \_ imap
7847 ? S 0:00 \_ imap
7848 ? S 0:00 \_ imap
7856 ? S 0:00 \_ imap
7858 ? S 0:00 \_ imap
7862 ? S 0:00 \_ imap
7864 ? S 0:00 \_ imap
23838 ? Ss 0:00 pure-ftpd (SERVER)
23840 ? S 0:00 /usr/sbin/pure-authd -s /var/run/ftpd.sock -r /usr/sbin/pureauth
24020 ? Ss 0:00 crond
24406 ? S 0:00 cpdavd - accepting connections on 2077 and 2078
24431 ? S 0:00 cpsrvd - waiting for connections
24511 ? S 0:00 queueprocd - wait to process a task
25635 ? S 0:00 tailwatchd
25661 ? SN 0:00 cpanellogd - sleeping for logs
25741 ? Ss 0:00 /usr/sbin/saslauthd -m /var/run/saslauthd -a pam -n 2
25789 ? S 0:00 \_ /usr/sbin/saslauthd -m /var/run/saslauthd -a pam -n 2
25944 ? Ssl 0:00 /usr/sbin/named -u named
5504 ? S 0:00 /bin/sh /usr/bin/mysqld_safe --datadir=/var/lib/mysql --pid-file=/var/lib/mysql/server.pid
5563 ? Sl 0:00 \_ /usr/sbin/mysqld --basedir=/ --datadir=/var/lib/mysql --user=mysql --log-error=/var/lib/mysql/server.err --pid-file=/var/lib/mysql/server.pid
5479 ? S< 0:00 litespeed (lshttpd)
5482 ? S< 0:00 \_ httpd (lscgid)
5483 ? S< 0:00 \_ litespeed (lshttpd)
5484 ? S< 0:00 \_ litespeed (lshttpd)
root@server [~]#