I think that can be set various ways. For example DHCP (which you mentioned), Group Policy, derived from the domain suffix or locally assigned. If it is being set with DHCP, you could easily see that in Wireshark if you do a release and renew. That would at least tell you of you are looking in the right place.
Thanks Paul, my co-worker setup a secondary VLAN on the same subnet as the rogue DHCP machines, then we did a trace ip mac from source to destination IP. It turned out to be two laptops on the network, after our security team scanned their machines, one had ICS turned on, on their wireless network but I don't understand how that was causing problems on the wired. I did check ICS status only on the wired.