If this were the case, then the router logs could show BOOTP/DHCP traffic, proving they booted something other than the programmed OS. The file transfers for it would also be fairly different in terms of total bytes transferred than normal machine traffic while working regularly.
To put it bluntly, the router / Splunk logs would be the smoking gun if these machines PXE Booted a different OS.
If this were the case, then the router logs could show BOOTP/DHCP traffic, proving they booted something other than the programmed OS. The file transfers for it would also be fairly different in terms of total bytes transferred than normal machine traffic while working regularly.
To put it bluntly, the router / Splunk logs would be the smoking gun if these machines PXE Booted a different OS.