The WAFM tables are used by the KFM File manger behavior. If you have pages on your site that use a file manager, then those pages will need those tables.
Do you have a cron job in place that is set to delete columns from your table?
or maybe a page in your site that manages the brevents table that is not secured?