"'ipconfig /all' on the DHCP server turns up no other interfaces with the offending IP range."
Im not sure what that is suppose to mean? He was asking you if this was a wireless or wired connection. If wireless they could just be connecting to a different wireless network than yours. If its on their wired interface then yeah you have something connected to your network running dhcp.
if wireless, just setup your wireless clients not to connect to that network. Since you mention 2 AP on your own network, I am thinking maybe its just wireless.
But if wired, what is the mac address? You can then look this up and see what type of device it is..
You say you can access a webgui on it.. at 192.168.99.1 when from these devices - so look in their arp table "arp -a" and get the machttp://www.coffer.com/mac_find/http://www.macvendorlookup.com/
That might help you spot it.
If not I would suggest you get yourself a smart switch that can list what ports a mac is listed on..
Interface: 192.168.1.100 --- 0xb
Internet Address Physical Address Type
192.168.1.7 00-0c-29-dd-02-ba dynamic
192.168.1.8 00-0c-29-57-41-d5 dynamic
192.168.1.25 00-13-b6-02-6c-09 dynamic
192.168.1.40 2c-76-8a-ad-f6-56 dynamic
192.168.1.50 00-15-99-21-1c-a0 dynamic
192.168.1.97 00-1c-c3-09-05-7a dynamic
192.168.1.220 7f-bf-a9-aa-29-5b dynamic
192.168.1.253 00-50-56-00-00-02 dynamic
192.168.1.255 ff-ff-ff-ff-ff-ff static
220.127.116.11 01-00-5e-00-00-fb static
255.255.255.255 ff-ff-ff-ff-ff-ff static
So for example I look at this one
So if I look 2c-76-8a up I gethttp://www.coffer.co...string=2c-76-8a
Tells me its an HP.. while that makes sense since its my HP Microserver. Now you see from the switch listing its mac table that its connected to port 4.. So I could trace out the wire to what is connected port 4 and find it.
So you will notice more than 1 mac on a specific port.. Those are downstream switches that are connected to those ports. So your smart switch lists all the mac that are on the that downstream switch. This would tell you at list what switch your connected too if you have more than 1.
But sounds like you only have 1 switch, so you could replace it. Or when a box gets that wrong address.. Run a constant ping on the IP of the dhcp server IP that hands it out, and then from your switch start pulling every other wire 1 at a time (other than the workstation that has the wrong ip) and find out what wire your device is connected too.
But a smart switch would be less intrusive method
You can can get a smart switch for really cheap these days. What size switch and speed do you have currently?
You sure you doublechecked your AP?? Those seem like likely candidates for having their dhcp servers turned back on.