Recommendations/Investigative actions
Identify the asset call the POC (Point of Contact) at the site and ask if some kind of activity was performed. In addition, look for a relevant cyber attack rules at the same time, it can be an attampt of the attacker to performe an Arp Poisoning attack