For those of you playing along at home...
The odd data was coming from a 1785-KE module on a different site 2 miles away. KE modules are supposed to be transparent but if you address them they will respond, though they are only capable of responding with the diagnostic registers.
DF1 half duplex is a broadcast format so when I polled that address for an N register every device with a radio could hear that request. Since the KE heard it, it could only reply saying I can't do that. But it WAS a proper reply and it was processed as such right along with the intended stations reply mangling the entire thing.
I found it by polling only that one address, then going into one remote radio at a time through ssh cli, turning off the com port for that location and seeing if replies stop. When they did I had my location.
After driving to the location, RSLinx showed me the addresses on the DH+ network and the KE was obviously the culprit. Changing the address of that KE module was all it took to exorsize the demon.
The reason this was never seen before was that old radio system (Esteem 192C) handled DF1 internally. It encapsulated and routed the traffic to ONLY the intended destination radio programmed into the master polling radio. Because of that the other sites never heard the broadcast so the module never had to respond. The new radios from GE (Orbit MCR) do not provide the ENI option like the SD radios did so they can't do anything but broadcast it.
BTW, The PLX51-ENI module does not handle this kind of error very well. TCP resets are not the proper thing to do. That sent me on wild goose chase.
Well that's over. Thanks Ken for all the help trying to decode what this thing was. If you ever work out a way to msg for ID, that might be helpful to anyone still dealing in the forgotten dark magic of DF1 over radio.
.