So far I have not had time to look at this.
We decided to just take the machine off our network for now and replace with a new box. Machine was 6 years old so it was not really worth the time. Maybe when things are slow I will look further into the logs and get back here to post.