One place to look is Application Class AP.Payment.PayCycle, and method SetUpApy2055 in particular. This method sets the parameters for the positive pay process, including the filename. However, it appears to be just passing the value from a work record, which I believe would come from the PayCycle manager component. This code was modified by bundle 24, but I'm not sure it would have affected the resulting filename.
It also looks like bundle 24 modified Step02 in section MAIN of AP_APY2055, and the code appears to be building the positive pay filename. This would be a good place to start. If this doesn't get you there, you'll have to backtrack into the PayCycle Manager component code.