@atom nope ldap queries by osquery to the ldap server. Spitballing here, could it be related to each host querying the user_* tables? Perhaps these are triggering ldap lookups?