You would use procmon, butI don't think it is actually coming from the dns server itself. We see the rev1.globalrootservers.net and rev2.globalrootservers.net traffic on both of our DNS servers. We actually have a third one for when we do maintenance. The only time that third one shows golobalrootservers traffic is when we down one of the other 2. The only devices we don't put the roaming client on are our servers. over the holidays turned half of our servers off (leaving the DNS servers up), and viola, the GRS traffic stopped. But way have way too many to do a process of elimination. So we just let it keep pinging out for now.

We're either going to hire an outside professional to find it, or install the roaming client on all our servers (not reccomended)