So our internet at work today was at a crawl, and surprisingly I traced it to one PC which appeared to have a virus but more digging revealed it was the Windows Update system uploading to external IP's outside the network.
Apparently windows 10 by default allows the PC's to act as torrents...