It's a server with two named instances - it happens on both instances, in any database - but only when connected remotely, not when logged on to the server itself and connecting locally via TCP/IP ... and just as I thought to write that, a very big bell started ringing - I believe we deployed a new IDS on the subnets in that data centre last week. I'll speak to someone who has access to the IDS logs tomorrow to see if I can tie it down to that. Not 100% sure that will be the answer, but I would take a reasonably hefty bet on it.

Thanks for the questions - I don't think I would have got there without them.