First off I am NOT an Avaya guy, but are any of the digital stations off premise? Sounds to me like the surge is coming into the dig ports. I have seen this on an IPO that had several buildings connected with cable with no bonding. Kept blowing the station ports until they finally protected them.