The error message comes from:

https://cs.corp.google.com/chromeos_public/src/third_party/autotest/files/client/site_tests/security_SandboxedServices/security_SandboxedServices.py?q=%22New+services+are+not+allowed+to+run+as+root%22&dr=C&l=333

jorgelo@, based on the git history, you should be familiar with this directory. Could you please suggest the right person to own this? Thanks so much.

This means somebody added a new service running as root. You should find
who added that.

This happened again today, but only seems to be intermittent:
https://uberchromegw.corp.google.com/i/chromeos.chrome/builders/veyron_minnie-tot-chrome-pfq-informational/builds/7510

The only code reference I see to "evemu-device" is here:
https://cs.corp.google.com/chromeos_public/src/third_party/autotest/files/client/cros/input_playback/input_playback.py?type=cs&q=evemu-device+file:%5Esrc/third_party/autotest/+package:%5Echromeos_public$&l=164

... but I don't see any recent changes in that folder that are likely culprits.  Also, looks like the same problem as  Issue 795128 ?

Same flake observed on caroline-tot-chrome-pfq-informational:
https://uberchromegw.corp.google.com/i/chromeos.chrome/builders/caroline-tot-chrome-pfq-informational/builds/1186