Before getting involved in tracing where a current draw is, the first thing you need to do is do a full system scan of all the modules and see what codes there are. The vehicle may actually be waiting to tell you where the fault is in a roundabout way. For example a VW with a communication code for the radio would suggest that the radio can no longer get the command to go to sleep, so it stays awake waiting for that command even though the display turns off.
The modules on modern vehicles can take up to 2 hours to go to sleep. If a vehicle has a current draw leave the doors open but latch them [tie a rag around the locator so you don’t slam it by accident] and make sure any door switches are disabled so everything appears to be closed to the modules, do the same with the hood . That way you don’t keep waking the modules up each time you open a door or the hood. Some vehicles will wake up seat modules amongst others when the door is opened, in preparation for someone to get into the vehicle.
Use the oscilloscope to measure the voltage drop across a thin piece of wire in series with the battery and measure the current with a clamp meter so you know what current that voltage represents. A 1 ohm resistor in series with the current draw will give a 1v pattern for each 1 amp of current flow - but for larger current drains this can mean that the voltage may drop too low for modules to operate, and will cause further faults. A roll of thin wire does a better job because even though it creates lower voltages to work with it allows for higher currents before faults are caused.
Set the oscilloscope to a 1 hour, or longer, recording pattern and watch the voltage change while doing something else.
In the following image the red line is 0v while the yellow line shows current draw over time, in this case it was ‘pulsing’ for 5 seconds at a time.
When the fault occurs remove fuses one at a time OR measure the voltage drop across the two contacts of each fuse to see which one has a current draw. If one of them has a current draw there will be a voltage drop across its contacts, that way the modules don’t wake up just because the fuses get plugged back in each time. If several modules are contributing to a current draw do a full system scan to see which ones are still awake. Go through the inputs of each module in live data to see why they are awake. A faulty glovebox switch on a Porsche can make all the seat modules and BCM wake up and stay awake each time a door is opened - because it assumes someone must be in the vehicle if the glovebox is open, so the modules stay awake in case they want to adjust the seat.
Other things to check are current drain through the alternator [leaking diodes] and if there is nothing obvious, the driving habits of the owner. Lots of short trips in winter with the lights and wipers and heater going may drain more from the battery than gets put back in while driving.