You can use nmap  for this;
read my answer here:

https://serverfault.com/questions/993783/how-can-i-check-my-pxe-server-configuration/

Gathering the different answers and filtering by e.g. MAC address, you can easily pinpoint the presence of a rogue PXE server.

It should be considered that PXE information (NBP and TFTP server IP) can be located either at the body of the DHCPOFFER packet (`file` and `next-server` fields) or as the corresponding DHCP options.