There's a keysym XF86LogGrabInfo which when pressed causes the X Server to print information about all the grabs in its log file (usually /var/log/Xorg.$DISPLAY.log). If you have xdotool installed, you can trigger that key with a command like
xdotool key XF86LogGrabInfo
From there you could identify the culprit X11 client. For instance, to determine which X11 client is messing with the "Space" key, I first get the keycode bound to the space keysym:
$ xkbcomp $DISPLAY - | grep SPCE <SPCE> = 65; key <SPCE> { [ space ] };
(you can also use xev + press Space for that), then I search for it through Xorg.$DISPLAY.log:
$ awk '/registered grabs of client/{c=$0}/detail 65/{if(c)print c; c=""; print}' /var/log/Xorg.0.log [452727.209] Printing all registered grabs of client pid 32055 openbox --config-file /home/pi/.config/openbox/lxde-pi-rc.xml [452727.220] detail 65 (mask 0), modifiersDetail 8 (mask 0) [452727.220] detail 65 (mask 0), modifiersDetail 24 (mask 0) [452727.220] detail 65 (mask 0), modifiersDetail 10 (mask 0) [452727.220] detail 65 (mask 0), modifiersDetail 26 (mask 0) [452727.241] detail 65 (mask 0), modifiersDetail 12 (mask 0) [452727.241] detail 65 (mask 0), modifiersDetail 28 (mask 0) [452727.241] detail 65 (mask 0), modifiersDetail 14 (mask 0) [452727.241] detail 65 (mask 0), modifiersDetail 30 (mask 0)
modifiersDetail 8 is Mod1Mask aka Alt, etc.
So it's openbox which is stealing the Alt-Space key combo.
Notice that the pids and command lines of the clients are not always accurate; they're those of the processes who connected to the Xorg unix domain socket, which may no longer exist if they forked in the meanwhile and their children inherited the socket file descriptor (That's a general problem with the naive misuse of SO_PEERCRED "authentification", which is quite a long story ;-))
~/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-keyboard-shortcuts.xml.