you can use netstat for this; read my answer here:
https://serverfault.com/questions/993783/how-can-i-check-my-pxe-server-configuration/
gathering the different answers and filtering by e.g. mac address you can easily pinpoint the presence of a rogue