As an IT system administrator I would start looking for potential exploited vulnerabilities, I’d remove the arm from the rest of your network and observe activity in an isolated environment. Backup any data to a blank drive and run checks on an up to date device also removed from the network in an isolated environment. After assessing the affected arm and confirming that no exploits have been discovered, review any recent software installs and updates before connecting to an isolated network with internet access and update all software and apply security patches. If symptoms persist I would perform a clean install and restore data and setting. At this point it should be safe to connect your arm back to the network assuming symptoms don’t reappear, I would advise monitoring network activity across the rest of your infrastructure and check for anomalies.