Isolating chunks of the network one at a time, waiting about 30 minutes between each step. The main switch has 48 ports, most of them uplinks to additional switches, so I pulled 12 of them at a time (third group did it), then 4 of the offending 12 (fourth was it), then found the one of those 4...