Same problem here. Every day the code is back.
My wp-includes/nav-menu.php was infected with strange code, I removed that code. Further I found a strange PHP-file (license.php) in wp-includes/Text/.
All removed and still code is coming back. I will keep searching.
In the audit log of plugin Sucuri Security I saw that user 'system' with IP ::1 changed the header.php of my template again yesterday evening.