OK, the issue was a Cisco VPN Client. Vendor plugged into the network and launched his VPN software, the private address' showing as "Spoof IP's" were the virtual adaptor and virtual gateway.

This poses a few different questions, I'll try to address them in a later post. Thanks for the help.