Do you see anything across your logging in and around the time you saw the spike? Usually something is going on and I'd bet you have a user doing a big sync job or something along those lines :-)
Kyle Kerst
Lead Internal Network/System Administrator
SmarterTools Inc.
smartertools.com