Thanks again for another helpful reply, looking into DHCP messages sent me down the right path. It looks like the IP conflict issue is caused by a wireless mesh range extender that somebody has connected to the network. It looks like some clients (probably connected to the mesh extender) are going through the DHCP DORA process, ARP requesting to check their leased IP address is not in use, then receiving an ARP response from the mesh extender which would cause them to DHCPDECLINE and restart the process. At least that is what the packet capture has led me to believe. I have since blocked the range extenders MAC address from the APs and haven't seen any of the problem events in the logs.
... View more
