Many thanks for all your answers. We tracked down the culprit eventually - it was one of the machines I do not manage. Yes, it is a struggle if the router is not in gateway mode.
The only way I could see was to run logging on the router.
I was trying to get the router to log to syslog, which I basically managed, but couldn't figure out how to filter to it's own log file. I guess it comes in under one of the 'local' lines, but not sure which.
Any ideas on this ?
B. Rgds
John