Perhaps the easiest thing you can do from a network perspective is to take a trace during this peak time, and use the Top User expert to see if there's any one user that is monopolizing bandwidth. Top Users is available on
www.codeplex.com/nmexperts.
When you take the trace, be aware that on a 1gig network, the load on the capturing machine could be a problem given a large amount of network traffic. I would recommend using NMCap with not filter and monitoring the command line to make sure the pending count doens't continue to grow over a 15 minute period. If load on the server is a concern, you might opt to capture on a mirror port on your switch instead. In that case remember to turn on promiscuous mode to capture all the servers traffic. Also, depending on the traffic you might opt for a chained capture or a circular capture. In either case I would use a large buffer size, 200M-500M.
Once you determine if there are clients monoplizing the connects, you could dive further into the trace to see what they are doing. If this is SQL traffic, you could filter on "TDS" to see just that traffic. Then find the clients in the conversation tree to narrow down what each is doing.
Paul