How to find Android app responsible for ARP spoofing?

A family member's OnePlus 7T (latest factory firmware) keeps trying to sporadically but frequently ARP spoof the local default gw address on our wifi. Is there a way, perhaps involving adb, that would help me find the app or process responsible? (I'm fairly certain it's the phone, and not some device that tries to implicate the phone, because it only happens when the phone is actually around.)