@DustinB3403 they're cheapo TP-Link routers acting as APs (they have an AP mode) I think they are sus because technically they are capable of DNS and DHCP themselves...could be one going rouge

UPDATE: We have replaced the router, wifi APs and enabled DHCP forwarding .... it hasn't gone down since! *Really don't want to Jinx it" Thanks all for you help I really appreciate it