Armed with the above information, the next step was to perform some packet traces to see what I could find. Thankfully (?) the problem is continuous, so I could time my traces to only capture the spikes and I could wait until late in the night to limit the extraneous packets as much as possible. Doing this a bunch of times I was able to isolate what seems to be the problem. However, correlation does not imply causation, it merely points a finger in its direction. I won't really know until Monday when I'm able to stop the process to see if the spikes disappear.
Because the traffic flows over a vif, I can only capture the entire vif and not an individual interface. I also do not know how our 6509 was configured, so I can't attempt to calculate over which port the traffic from this client would be directed, but the amount and type of traffic leads me to believe that I have found the culprit. This particular application server runs a program within a DOS on a Windows 98 PC. It sends hundreds of search requests at exactly the same time as the CPU spikes. Researching this shows some related bugs - 35047 or 40348.
If this is the problem, then I'll see what can be done about the application. If nothing, then I'll be opening a case.
Thanks to the personal replies I received from NetApps.