Thanks guys. As this is a Layer2 switch, my guess is that the ARP messages are coming from the default-gw for the VLAN where the switches are inside for management. Which is a Fortinet Firewall. But we will run a packet sniffer as soon as we find a free minute... will keep you updated.