Some sessions or all?
If not all, are they restricted to any particular subnet? IOW, is it just
x.x.Y.x, or is it both x.x.Y.x and x.x.Z.x?
Anything in QSYSOPR, or DSPLOG, around that time (other than "job ended")?
Anything in WRKPRB?