Ok... the next logical suspect is a "runaway query" that has at least one accidental many-to-many join (also known as a data driven Cross Join).  You need to capture the code that's running when one of these incidents occurs along with some cpu and IO usage stats so that you can figure out which code it is that needs to be fixed.

If it was bad enough to overwhelm resource usage of "normal" code over time, you might be able to find it in the "standard" instance level reports that are built into the "Reports" pulldown when you right click on the instance in the Object Explorer window.  If not, you need something like Adam Machanic's sp_WhoIsActive to find such a thing while it's running.