Sounds like you need put on your network management hat or get your network support folks involved. Have them look at netstat and maybe use the procexp.exe utility from Sysinternals/Microsoft to see if it can track down the open connections and narrow it down to a workstation. If they are unable to track it to a workstation, then you may need to open a support case with Microsoft.
For more ideas check out a couple of my blog entries:
Nifty tools for tracking down that “interesting” network traffic – You can ignore the first half of this as it talks about Cisco routers. It’s the last half that might be of interest in tracking down IP connections and processes talking to those connections.
Did you see this? – Process monitor now does TCP/UDP monitoring
In the IT trenches? So am I – read my IT-Trenches blog.